Remove Browser Hijack from Chrome on Mac

Browser hijacking on a Mac usually means your Chrome homepage, new tab page, or search engine suddenly changed, or you’re seeing constant pop-ups and redirects. This guide walks you through removing the unwanted extension, profile, or launch agent causing it, and restoring Chrome to normal. You’ll need about 15 minutes and access to your Mac’s user folders — no special tools required.

What You’ll Need

• Your Mac’s administrator password (for deleting files from system folders if needed)
• Chrome closed and reopened a few times during the process
• Patience — some hijackers hide in multiple places

Step-by-Step

1. Close Chrome completely. Press Cmd+Q or choose Chrome > Quit from the menu bar. Make sure no Chrome windows remain (check the Dock for a dot under the icon).
2. Open Chrome and check for suspicious extensions. In the address bar, type chrome://extensions and press Enter. Look for any extension you didn’t install or don’t recognize — common ones are “Search Manager,” “New Tab,” or anything with a generic name. Toggle off each suspicious extension, then click “Remove” to delete it. If the extension is grayed out or says “Managed by your organization,” skip to the troubleshooting section.
3. Reset Chrome’s settings. Go to chrome://settings/reset and click “Restore settings to their original defaults.” This resets your homepage, search engine, and new tab page, and disables all extensions. Confirm when prompted. This step often removes most hijackers.
4. Check your homepage and search engine. Go to Chrome > Settings > Search engine, and set your preferred engine (e.g., Google). Then go to Settings > On startup, and choose “Open the New Tab page” or set a specific URL you trust. Also check Settings > Appearance > Show Home button — if enabled, click the pencil icon and set a safe URL.
5. Remove malicious launch agents and login items. Open System Settings > General > Login Items. Look for any unfamiliar apps that launch at login (e.g., “Helper,” “SearchApp,” or random names). Select them and click the minus (−) button. Then, open Finder, press Cmd+Shift+G, and type ~/Library/LaunchAgents. Look for .plist files with suspicious names (like com.searchhelper.plist). Delete any that are not from known software (Apple, Adobe, etc.). Also check /Library/LaunchAgents and /Library/LaunchDaemons (you’ll need admin rights).
6. Clear Chrome’s cache and cookies. Go to chrome://settings/clearBrowserData, choose “All time,” check the boxes for “Cookies and other site data” and “Cached images and files,” then click “Clear data.” This removes any scripts that might re-inject the hijacker.
7. Check for unwanted profiles. In Chrome, click your profile icon (top right) and look for any profiles you didn’t create. If you see one, click the gear icon → “Manage profiles,” then delete the suspicious profile.
8. Restart your Mac. After completing the above, restart your Mac to ensure any background processes are killed. Then reopen Chrome and verify that your homepage and search engine are back to normal.

Common Mistakes

• Skipping the extension check. Many hijackers are extensions that survive a simple reset. Always check extensions first.
• Only resetting Chrome settings. If the hijacker has a launch agent, it will re-add the extension after reset. You must remove the launch agent too.
• Deleting legitimate files. Be careful not to delete .plist files from Apple or trusted apps. Only remove ones you’re certain about.
• Not quitting Chrome fully. If Chrome is still running in the background (check Activity Monitor), some files are locked and cannot be removed.
• Ignoring the “Managed by your organization” message. This indicates a policy file that needs special removal — see troubleshooting below.

Tips

• Use Safe Mode (hold Shift while booting) to disable login items temporarily — this helps confirm if a launch agent is the cause.
• Keep your Chrome and macOS updated — hijackers often exploit old vulnerabilities.
• Install a reputable ad-blocker or security extension (e.g., uBlock Origin) to reduce the risk of future hijacks, but only from the Chrome Web Store.
• Regularly review your extensions and login items — do it monthly.
• If you use a password manager, change any passwords that might have been exposed during the hijack, especially for email and banking.

Troubleshooting

Chrome still shows the hijacker after following all steps. Try this: Go to chrome://policy and see if any policies are set. If you see entries like “HomepageLocation” or “ExtensionSettings,” the hijacker has set a policy. To remove it, you’ll need to edit the file /Library/Managed Preferences/com.google.Chrome.plist (or the user version in ~/Library/Preferences). Open it with PlistEdit Pro or Xcode, delete the offending keys, and save. You may need to restart Chrome. If you’re not comfortable editing plist files, consider using a dedicated removal tool like Malwarebytes for Mac (free version) — it can find and remove these policy files automatically.

Extensions keep coming back after removal. This means a launch agent or a background process is re-downloading them. Check your LaunchAgents again, and also look in ~/Library/Application Support/Google/Chrome/Default/Extensions for any folders that reappear after deletion. Delete them again, then immediately restart your Mac.

You can’t delete a file because it’s “in use.” Close all apps, then open Activity Monitor (search in Spotlight). Look for processes with names like “Helper,” “Search,” or the hijacker’s name. Select them and click the X to force quit. Then try deleting again.

Your homepage is set to a URL you can’t change. This is often a policy issue. Follow the policy removal steps above. If that doesn’t work, try creating a new Chrome user profile (Settings > People > Manage profiles > Add profile) and see if the new profile is clean. If it is, you can migrate your bookmarks and passwords and delete the old profile.

Frequently Asked Questions

How did my Mac get a browser hijacker?

Most commonly from installing free software that bundles extra programs, clicking fake download buttons on shady websites, or opening malicious email attachments. Always read install prompts and choose “Custom” install to deselect extras.

Can a browser hijacker steal my passwords?

Some can. If they redirect you to fake login pages, they can capture credentials. After removing the hijacker, change important passwords and enable two-factor authentication where possible.

Is resetting Chrome enough to remove the hijacker?

Often yes, but not always. If the hijacker has a launch agent or policy file, it will return. That’s why the full removal process includes checking those areas.

Will I lose my bookmarks and passwords if I reset Chrome?

No, resetting Chrome settings does not delete bookmarks, passwords, or history. It only resets settings like homepage and disables extensions. However, if you delete a user profile, you will lose that data — so back it up first.

What if the hijacker is on my iPhone or iPad?

Chrome on iOS is sandboxed, so hijackers are less common. If you have pop-ups, clear Safari/Chrome data and check for VPN or profile configurations in Settings > General > VPN & Device Management.

Should I use a paid removal tool?

Free tools like Malwarebytes for Mac are usually sufficient. Paid tools are not necessary for most cases. If you’re not comfortable with manual steps, a free scan is a good start.

Related

• Microsoft Copilot Not Working on Mac? Fixes
• Fix Spotify Crashing on Windows: 7 Real Fixes
• Private Mode on Pixel & Pixel XL: How to Use It