How to Find and Remove Malicious Browser Extensions

The Problem

Browser extensions have more access than almost anything else on your PC. An extension with "read and change all your data on all websites" can see everything you type — including passwords and one-time codes — rewrite pages, inject ads, and quietly redirect your searches.

The dangerous part is that an extension does not have to start malicious. A useful little tool with 200,000 users gets sold to a new owner, ships an update, and now it is an ad injector. You never reinstalled anything. It updated silently.

Coupon finders, screenshot tools, PDF converters, video downloaders, and "dark mode for everything" add-ons are the categories this happens to most often.

Search results already redirecting? That is usually a broader hijack — work through remove a browser hijacker and search redirect as well as this.

Symptoms

Ads on sites that do not normally carry them, or ads that look inserted into the page layout.
Search results routing through a domain you do not recognise before landing on Google.
Affiliate codes appearing in shopping URLs you did not click.
An extension icon you do not remember installing, or one that reappears after removal.
The browser suddenly using far more memory — see reduce Chrome memory usage.
New tabs opening on their own, or a homepage you did not set.

The Fix: Step-by-Step

Step 1: List Everything Installed

Chrome: address bar → chrome://extensions → turn on Developer mode (top right). Edge: edge://extensions. Firefox: about:addons → Extensions.

Developer mode matters — it reveals each extension's ID, which is what you use to look it up and to spot one that has been sideloaded rather than installed from the store.

Step 2: Judge Each One on Four Questions

For every extension, ask:

Did I install this deliberately, and do I still use it? Unused is a reason to remove regardless of trust.
What permissions does it have? Click Details. "Read and change all your data on all websites" is the highest-risk grant. A tool that only needs to work on one site should not have it.
Is it still in the store? Click View in Chrome Web Store. A dead link means it was pulled — usually for policy violation. Remove immediately.
Who publishes it now, and what do recent reviews say? A wave of one-star reviews in the last few months saying "this started injecting ads" is exactly the ownership-change pattern.

Step 3: Check for Sideloaded and Policy-Installed Extensions

Two categories you cannot simply delete:

Installed by enterprise policy — shows a "Managed by your organisation" note and a greyed-out remove button. On a personal PC this is malware using policy to make itself sticky.
Installed by a program on your computer — sideloaded by a desktop installer via the registry.

For the policy case, in Terminal (Admin):

reg query "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist"
reg query "HKLM\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist"

If entries exist that you did not put there, delete the offending values, then close and reopen the browser. On a work laptop, these are legitimate — leave them and speak to IT.

Step 4: Remove and Then Verify It Stayed Removed

Remove the extension, fully close the browser (check Task Manager for lingering browser processes), reopen, and check the list again.

An extension that returns after a restart is being reinstalled by something else on the PC — a scheduled task, a service, or a startup entry. Go to remove malicious scheduled tasks and startup persistence.

Step 5: Clean Up What It Changed

Removing the extension does not undo its settings changes.

Search engine: chrome://settings/search → set your real default → Manage search engines → delete unfamiliar entries.
Startup pages: Settings → On startup → set to New Tab page.
Notifications: Settings → Privacy and security → Site settings → Notifications → remove sites you did not approve. See stop browser notification spam.
Shortcut hijack: right-click your browser desktop shortcut → Properties → the Target field must end at chrome.exe or msedge.exe with nothing after it. A URL appended there reopens the hijack every launch.

Step 6: Check Your Profile Is Not Syncing It Back

If the extension was installed while sync was on, signing in on another device brings it back — and re-signing in on this one can too.

Chrome: chrome://settings/syncSetup → confirm extensions sync is behaving, and check every device signed into the profile. Edge: edge://settings/profiles/sync.

Repeat the audit on every device using that profile, or the cleanup is temporary.

Step 7: Change Passwords the Extension Could See

An extension with full site access could read anything you typed, including passwords and pasted 2FA codes. Assume exposure.

From a device you trust, change your email password first, then banking and anything reusing that password. Then check review and revoke app access and active sessions — a stolen session cookie keeps working even after a password change until you sign out everywhere.

Step 8: Scan the PC Itself

Sideloaded extensions arrive with a desktop program. Run a Full scan in Windows Security, then a Microsoft Defender Offline scan — the full procedure is in remove virus and malware. Also check Settings → Apps → Installed apps, sorted by install date, for anything that arrived the same day.

How to Not Repeat It

Install extensions only from the official store, and only ones you have a specific reason for.
Prefer extensions that request site-specific permissions over all-sites access.
Set high-risk extensions to On click access: Details → Site access → On click. They then only run when you invoke them.
Re-audit every six months. Removing an unused extension costs nothing.

What Not to Do

Do not install a "browser cleaner" extension to fix extension problems. That is the same trust model that caused the issue.
Do not ignore the "Managed by your organisation" banner on a personal PC. It is a policy planted to stop you removing something.
Do not keep an extension because it is useful when reviews say it changed hands and started injecting. Usefulness and safety are separate questions.

FAQ

How can an extension I installed years ago suddenly be malicious?

Extensions update silently, and the developer account can be sold. A buyer inherits the existing install base and pushes an update that adds ad injection or tracking. Nothing changes on your side — which is why periodic re-auditing, not one-time vetting, is what works.

What does "read and change all your data on all websites" actually allow?

Everything the page can do: reading what you type, including passwords and one-time codes, modifying page content, reading cookies for logged-in sessions, and sending it all elsewhere. Grant it only to extensions that genuinely need it, and prefer on-click activation.

Is the Chrome Web Store safe?

Safer than sideloading, but review is not a guarantee — malicious extensions get through and are removed after the fact, sometimes months later. Store presence is a minimum bar, not proof.

Why does the extension come back after I remove it?

Something on the PC is reinstalling it. The usual causes are an enterprise policy registry key, a scheduled task, a startup program, or profile sync from another device where it is still installed. Check all four.

Do extensions in Incognito or InPrivate mode still see my data?

Only if you explicitly allowed them to run in private mode, which is off by default. Check each extension's Details page and turn that permission off unless you have a specific need.

Should I use an ad blocker, given the risk?

Yes — a well-known, widely audited, open-source one from the official store. Ad blockers reduce your exposure to malvertising, which is a significant infection route. The risk is with obscure clones of popular blockers, not the category.

Still Not Working?

If ads and redirects persist after a clean extension list and a browser reset, the change is happening outside the browser: a proxy setting, a modified hosts file, or a DNS change. Check Settings → Network & internet → Proxy for an unexpected entry, and see remove a browser hijacker and search redirect.