SafePass.pro

Chrome extensions are stealing passwords — and Google just admitted the risk

Chrome extensions can steal passwords by reading autofilled forms, capturing keystrokes, and abusing browser permissions. Google just moved to block a related hijack tactic — here's how to protect yourself now.

By SafePass.pro Team · Published · Updated · 7 min read

Chrome extensions can steal your passwords by intercepting autofill data, reading form fields, and capturing keystrokes — often with permissions you approved once and forgot. On August 2, 2026, BleepingComputer reported that Google is preparing Chrome features to block policy-installed New Tab and search hijackers on unmanaged devices. That admission matters: Chrome's own engineers are treating force-installed extensions on consumer PCs as an active abuse problem. If your credentials were already harvested in an extension campaign, SafePass.pro's strength checker can test whether a password has appeared in known breaches — without uploading the full password to our servers.

What did Google just admit about Chrome extensions?

Google is preparing a default Chrome defense that blocks policy-installed extensions from hijacking the New Tab page or default search engine on unmanaged Windows and macOS devices.

BleepingComputer spotted the work in Chromium Gerrit. A Google engineer wrote that in "low-trust environments (unmanaged consumer devices), enterprise policy force-installs and recommendations are abused to lock in search engine or new tab page hijackers."

In plain English: malware writes local Chrome policy keys so Chrome thinks an "admin" installed the extension. You may see "Managed by your organization" on a personal PC — and you can't easily remove the hijacker.

The feature flag (kBlockDseNtpOverrideExtensionsOnUnmanagedDevices) is still under review and not in stable Chrome yet. It is Google acknowledging that extension policy abuse on consumer machines is real and widespread enough to ship a default block.

How do Chrome extensions steal passwords?

Malicious extensions steal passwords by running inside the browser with permissions that let them see what you type and what appears on the page — including autofilled credentials.

They typically abuse capabilities that also power legitimate tools:

  • Read and change page content — watch login forms, scrape autofilled fields, or inject fake prompts.
  • Access data on all sites — sit on banking, email, and shopping pages at once.
  • Intercept or observe network activity — in some cases, watch credentials leave the page.
  • Capture input — keyloggers in extension form remain a documented threat vector in 2025 research on malicious browser extensions.

Academic work on password managers has long noted the gap: once a manager autofills a password into the page, a malicious extension or injected script can read it before it reaches the website. Password managers reduce reuse risk; they do not magically stop a compromised browser process from seeing what is already in the DOM.

Can password managers stop Chrome extension attacks?

No — not completely. A password manager still helps a lot, but autofill happens inside the browser, where a malicious extension can sit.

Use a manager for unique passwords and vault encryption. Treat extension hygiene as a second control:

  • Prefer manual fill or "fill on click" for high-value accounts (email, bank, password manager itself).
  • Limit each extension's site access to On click instead of all sites.
  • Never install a "helper" extension you do not fully trust — especially AI writing, job, or "VPN" tools that request broad page access. Palo Alto Networks Unit 42 has documented GenAI-themed extensions that exfiltrate email content, prompts, and credentials.

SafePass.pro is the layer alongside your manager: generate a clean password in the browser, confirm it has not appeared in known breaches, then save it in the vault — without installing yet another Chrome extension.

How does a New Tab hijacker relate to password theft?

New Tab and search hijackers are often the visible tip of a broader policy-abuse infection — and the same trust model that locks a hijacker in place can lock in worse extensions too.

Hijackers rewrite your New Tab or search so traffic (and sometimes queries) routes through attacker-controlled pages. Google's upcoming block targets that specific override on unmanaged devices.

Credential theft is a related but separate pattern: fake productivity extensions, compromised updates, and permission abuse that read forms rather than only changing search. Both thrive when Chrome treats a force-installed extension as "admin approved." Seeing a hijacked New Tab is a signal to audit every extension and every password, not only fix the start page.

How do I know if a Chrome extension is malicious?

You cannot judge by the Chrome Web Store badge alone. Look for behavior and permissions.

Red flags:

  • Unexpected "Managed by your organization" on a personal computer.
  • New Tab, homepage, or search engine changed without your consent.
  • Permissions like Read and change all your data on all websites for a tool that only needs one site.
  • Reviews mentioning redirects, pop-ups, or account lockouts after install.
  • An extension you do not remember installing, or one that reappears after you remove it.

Check policies at chrome://policy and extensions at chrome://extensions. If policies look unfamiliar on a home PC, treat the machine as compromised until proven otherwise.

What should I do right now to protect my passwords?

Run this checklist in order — it takes about fifteen minutes:

  1. Open chrome://extensions and remove anything you do not actively use. Prefer fewer, well-known tools.
  2. Open chrome://policy. On a personal device, unexpected forced policies are a malware warning — scan the PC and clean local policy keys with a reputable anti-malware tool.
  3. Tighten remaining extensions: set site access to On click where possible; revoke "all sites" access you do not need.
  4. Turn off automatic autofill for your password manager on sensitive sites, or use fill-on-demand only.
  5. Rotate high-value passwords — email, banking, cloud storage, and your password manager master password — with fresh unique values from SafePass.pro.
  6. Check whether old passwords were already exposed with the password strength checker (browser-side analysis + optional Have I Been Pwned k-anonymity check).
  7. Enable two-factor authentication on those same accounts so a stolen password alone is not enough.

For reusable hygiene habits, see our password security tips and how SafePass.pro works.

How does SafePass.pro help after an extension scare?

SafePass.pro helps you replace and verify passwords without adding another extension to the attack surface.

  • Generate locally — passwords are created with crypto.getRandomValues in your browser; we do not store them.
  • Breach-check privately — optional Have I Been Pwned lookups send only a short hash prefix (k-anonymity), never the full password to SafePass.pro servers.
  • No install required — use the web tools when you need a clean credential or a strength check, then store the result in your existing manager.

If you suspect an extension harvested logins, assume reused passwords are burned. Generate unique replacements for every account that shared them, starting with email. Pair that with phishing awareness — attackers who already have your email often follow up with fake "security" messages.

Key takeaways

  • Google is building default Chrome blocks against policy-installed New Tab and search hijackers on unmanaged devices — confirmation that this abuse is serious.
  • Malicious extensions can still read autofilled passwords even when you use a password manager.
  • Audit extensions, fix unexpected policies, rotate important passwords, and verify new ones with a private breach check.
  • Use SafePass.pro as the final check and generator next to your manager — not as another install you have to trust.

Frequently asked questions

How do Chrome extensions steal passwords?

Malicious extensions use browser permissions to read page content, watch autofilled login forms, capture keystrokes, or observe credentials after a password manager fills them into the page. Once the password is in the DOM, an extension with broad access can copy it.

Can password managers stop Chrome extension attacks?

Not completely. Password managers stop reuse and store credentials encrypted in a vault, but autofill still happens inside the browser where a malicious extension can read the filled field. Use a manager and also audit extensions, prefer fill-on-click for sensitive sites, and rotate passwords if you suspect compromise.

What did Google announce about Chrome hijacker extensions?

As reported by BleepingComputer on August 2, 2026, Google is preparing a Chrome feature that blocks policy-installed extensions from overriding the New Tab page or default search engine on unmanaged Windows and macOS devices. The change is still under review and not yet in stable Chrome.

How do I check if my password was stolen by an extension?

You usually cannot see the theft itself. Assume high-value or reused passwords may be burned, generate fresh unique ones, and test old passwords with a private breach check such as SafePass.pro's strength checker, which uses Have I Been Pwned k-anonymity so the full password is never sent to SafePass.pro.

Why does Chrome say Managed by your organization on my home PC?

Malware can write local Chrome enterprise policy keys so Chrome treats a force-installed extension as administrator-managed. That can lock New Tab or search hijackers in place and block easy removal. Check chrome://policy, remove suspicious extensions, and run anti-malware cleanup.

Keep reading

More SafePass.pro guides on passwords, breaches, and account security.

View all blog articles

Explore SafePass.pro tools

Free browser-based tools — generate, check, and learn without creating an account.

Sources

Generate a secure password