Browser hijacking is when unwanted software takes control of a web browser without the user's real consent — changing the homepage and default search engine, redirecting searches to pages the user never asked for, and injecting extra ads into results. It usually arrives bundled with free software, a fake "required" browser extension, or a link that promised a codec, a PDF or a discount code. On its own it is more nuisance than crisis, but it is rarely alone: the same install often carries adware or worse, and every redirect routes staff through attacker-controlled pages where credential theft is one convincing fake login away. For a small business, a hijacked browser on a finance or admin machine is a security problem wearing a nuisance costume.
TL;DR
- Browser hijacking is unwanted software that controls a browser: homepage, search engine and redirects all change.
- It arrives through bundled free downloads, fake extensions and fake alert pages, not through "hacking".
- A hijack matters because every redirect passes through attacker infrastructure — a road to phishing and malware, not just ads.
- Removal takes minutes when done in order: uninstall, clean extensions, reset settings, run a scan.
- Prevention is settings discipline: locked defaults, no random extensions, and staff who report instead of click.
How browser hijacking actually happens
- Bundled installers. A free PDF converter, video downloader or "system cleaner" arrives with pre-ticked offers to change the homepage and search engine. Staff click through the installer wizard and approve the hijack themselves.
- Fake browser extensions. A convincing extension with good reviews and a clean-sounding name — shopping assistant, currency converter, PDF tool — asks for "read and change all your data on all websites", which is exactly the permission it uses to inject redirects.
- Fake alerts and "required" downloads. A page claims the browser is infected or a video needs a codec or an update; the download is the hijacker. This is the same lure pattern as malvertising and fake CAPTCHA pages.
- Mobile apps that set their own browser defaults. On phones, a single tap on a scam "Open in Chrome" prompt can set a new default search app that quietly redirects later searches.
The common thread: the hijacker needs one ordinary click, and it gets that click by disguising itself as something routine.
The warning signs staff can spot
- The homepage, new-tab page or default search engine is different from what IT set — often to an unfamiliar name.
- Searches redirect through odd intermediate domains before landing on results.
- Ads appear where results used to be clean, or on sites that never showed them.
- Unknown extensions are listed in the browser even though nobody remembers installing them.
- Push-notification requests appear from news, shopping or streaming sites nobody visited on purpose.
Any one of these on a shared or finance machine should be treated as a security report, not a personal annoyance — the next page after the redirect is often a phishing login or a download.
How to remove a browser hijack, in order
- Uninstall the source. Check installed programs (Windows: Apps & features; macOS: Applications folder) for the freebie, cleaner or helper that arrived on the same day the hijack started — removal usually starts there, not in the browser.
- Remove unknown extensions. In every installed browser, review the extension list and remove anything nobody recognises. Extensions persist across restarts; the uninstall step above is what stops them coming back.
- Reset the browser settings. Chrome and Edge both offer "Restore settings to their original defaults", which clears hijacked homepage and search-engine entries without deleting bookmarks.
- Revoke notification permissions. Check Site settings → Notifications and remove the push sites that snuck in — that is where the ongoing pop-ups actually live.
- Run a full malware scan. A hijacker bundle frequently includes more than a homepage swap; a scan catches the rest. If the machine holds finance or admin access, treat credentials used on it as exposed and reset them after cleanup.
- Report it. One staff report lets you check every other machine for the same install — hijackers rarely arrive on just one laptop.
Preventing the next hijack
- Standardise the browser. Push the same homepage, search engine and bookmarks to every machine from your Google Workspace or Microsoft 365 admin console. A enforced default is hard to quietly replace.
- Allow-list extensions. Where the admin console supports it, restrict installs to a small approved list — extensions are the delivery vehicle of choice.
- Stop installing freebies. The software that needs bundling to get installed is the software that carries the hijacker; approved tools only.
- Train the click. Most hijacks start with a plausible download. Security awareness training rehearses exactly this moment, and monthly phishing simulations keep the report-don't-click reflex alive.
- Re-run the check. A security gap assessment should include a quick look at browser defaults and installed extensions across machines — it takes minutes and catches what users never mention.
Browser hijacking is one of the few attack classes where the user can both cause and fix the problem in the same afternoon — which is why the removal steps belong in training, not just in an IT runbook.
FAQ
What is browser hijacking in simple terms? Unwanted software changes how a browser behaves — homepage, default search engine, redirects and ads — without the user genuinely agreeing. It usually arrives bundled with a free download or a fake extension.
Is browser hijacking malware? It sits on the spectrum. Most hijackers are adware or potentially unwanted programs; the bundles they arrive with frequently include real malware, so treat every hijack as a suspected infection until a scan says otherwise.
How does browser hijacking get past my antivirus? Often the user approves it: the bundled installer pre-ticks the "change your homepage" box, or the extension is granted permissions at install. Antivirus sees a consented install — which is exactly why the click itself is the thing to train.
Can a browser hijacker steal passwords? Directly, usually not — the money is in ad redirects. But every redirect passes through infrastructure the hijacker controls, and that infrastructure is a natural next step to fake logins and downloads. A hijack on a machine that touches banking or admin consoles should be treated as a credential risk.
How do I reset a hijacked Chrome or Edge browser? Remove the source program first, then unknown extensions, then use the browser's "Restore settings to their original defaults" option, and clear notification permissions. Finally run a full malware scan — the hijacker is often a passenger, not the whole cargo.
How do I stop browser hijacking happening again? Enforce defaults from your admin console, allow-list extensions, ban random freebie installs, and keep staff reporting anything that changes without their input. The enforced defaults step does most of the heavy lifting.
One last thing
Open the extensions page on your own browser right now and count the ones you can't remember installing — then imagine that list on every staff laptop. Fifteen minutes with the admin console locking defaults and extensions is the whole prevention plan for this attack class.