Browser extension shows ads and redirects searches: remove it safely

TL;DR — If your browser suddenly shows extra ads, opens coupon pop-ups, or sends searches to unfamiliar sites, the most likely cause is a recently installed or updated browser extension. Start by disabling all extensions in your browser's extensions page, then re-enable them one by one; if the problem stops, remove the extension and reset your search engine, startup pages, and notifications. Reading time: ~6 min

The scenario

It is a normal Tuesday afternoon and you are just trying to look up a client email thread or search for a vendor login page. Instead of your usual search engine, your browser opens a strange results page, a shopping site, or a tab full of ads. You did not intentionally install anything suspicious, but you may have added a PDF tool, coupon helper, video downloader, or "search enhancer" extension recently. Now every search feels hijacked, and you want the fastest safe way to stop it without breaking your bookmarks, passwords, or work logins.

Symptoms

• Searches typed into the address bar open on an unfamiliar site instead of your normal search engine.
• Extra ads appear on pages that normally do not show them.
• Pop-ups or banners mention coupons, deals, "recommended results," or "sponsored search."
• New tabs open on their own when you start the browser.
• Your homepage or startup page changed without you intending to change it.
• Browser notifications appear from sites you do not recognize.
• The extension list shows a new item you do not remember installing.
• Typical wording you may see:
  • "Managed by your organization"
  • "Installed by enterprise policy"
  • "Your browser is managed"
  • "Change your search settings to continue"
  • "This setting is enforced by your administrator"
• In the browser's search settings, your preferred search engine is missing or keeps changing back after you fix it.

Likely causes

Step-by-step diagnosis

[You notice ads/search redirects]
            |
            v
[1. Disable all extensions]
            |
   ads stop? ---- yes ----> [Fix: remove bad extension]
            |
            no
            v
[2. Check search/startup settings]
            |
   changed? ---- yes ----> [Fix: reset browser settings]
            |
            no
            v
[3. Check notifications]
            |
   unknown sites allowed? -> [Fix: remove notification abuse]
            |
            no
            v
[4. Check browser policy]
            |
   forced extension? -----> [Fix: remove policy/app]
            |
            no
            v
[5. Check installed apps]
            |
   suspicious app found? --> [Fix: uninstall app + rescan]

1. Disable all extensions first

   • Chrome: Menu (⋮) → Extensions → Manage Extensions
   • Edge: Menu (...) → Extensions → Manage extensions
   • Firefox: Menu (≡) → Add-ons and themes → Extensions
   • Turn every extension off.
   • This is your problem if: the ads or search redirects stop immediately after you disable extensions.
   • Jump to: ### Recently installed or updated extension is injecting ads or changing search

2. Test in a private window

   • Chrome/Edge: Menu → New Incognito/InPrivate window
   • Firefox: Menu → New private window
   • By default, most extensions are off in private mode unless you allowed them.
   • This is your problem if: the browser behaves normally in the private window but not in the regular window.
   • Jump to: ### Recently installed or updated extension is injecting ads or changing search

3. Check your default search engine and startup pages

   • Chrome: Settings → Search engine and Settings → On startup
   • Edge: Settings → Privacy, search, and services → Address bar and search and Settings → Start, home, and new tabs
   • Firefox: Settings → Search and Settings → Home
   • This is your problem if: the search engine is unfamiliar, the homepage changed, or startup opens a site you did not choose.
   • Jump to: ### Browser search engine, startup page, or new-tab setting was changed by the extension

4. Check site notifications

   • Chrome: Settings → Privacy and security → Site settings → Notifications
   • Edge: Settings → Cookies and site permissions → Notifications
   • Firefox: Settings → Privacy & Security → Permissions → Notifications → Settings
   • This is your problem if: unknown sites are listed as Allow, especially shopping, gambling, fake antivirus, or "news" domains.
   • Jump to: ### Site notifications are allowed and look like ads, even after the extension is removed

5. Check whether the browser is managed by policy

   • Chrome: open this in the address bar:

chrome://policy

• Edge:

edge://policy

• This is your problem if: you see policies related to extensions, such as ExtensionInstallForcelist, or the extension page says Installed by enterprise policy.
• Jump to: ### Extension is being forced by policy (a management rule) or another app

1. Check installed apps on the computer
   • Windows: Settings → Apps → Installed apps
   • macOS: Finder → Applications
   • Sort by Install date and look for recent toolbars, PDF converters, coupon apps, download helpers, "search" apps, or anything you do not recognize.
   • This is your problem if: the extension returns after removal, or a suspicious app was installed around the same time the issue started.
   • Jump to: ### A separate unwanted app on the computer keeps reinstalling the extension

Fixes

Recently installed or updated extension is injecting ads or changing search

1. Open your browser's extensions page.
2. Remove the suspicious extension:
   • Chrome/Edge: Manage Extensions → Remove
   • Firefox: Extensions → ... → Remove
3. If you are not sure which one is bad, re-enable extensions one at a time and test after each one.
4. Remove extensions you do not actively use, especially coupon tools, downloaders, "safe search," VPNs from unknown publishers, and PDF converters.
5. Restart the browser.

Verify it worked: search from the address bar three times; all three should go to your expected search engine with no extra tabs or ads.

Browser search engine, startup page, or new-tab setting was changed by the extension

1. Reset the changed settings manually.
   • Chrome:
     • Settings → Search engine → choose your preferred engine
     • Settings → On startup → select Open the New Tab page or remove unknown pages
   • Edge:
     • Settings → Privacy, search, and services → Address bar and search → set Search engine used in address bar
     • Settings → Start, home, and new tabs → remove unknown startup pages
   • Firefox:
     • Settings → Search → set Default Search Engine
     • Settings → Home → set homepage and new windows/tabs
2. If settings keep changing back, return to the extensions page and remove the extension that changed them.
3. If the browser still behaves oddly, use the browser reset option:
   • Chrome: Settings → Reset settings → Restore settings to their original defaults
   • Edge: Settings → Reset settings → Restore settings to their default values
   • Firefox: type about:support → Refresh Firefox

⚠️ Resetting browser settings can sign you out of some sites and disable custom startup pages. It should not delete saved bookmarks or saved passwords, but read the prompt before confirming.

Verify it worked: close and reopen the browser; the homepage, new tab, and address-bar search should stay on the settings you chose.

Site notifications are allowed and look like ads, even after the extension is removed

1. Open the browser notifications settings page.
2. Remove or block unknown sites from the Allow list.
3. If there are many, set notifications to ask first instead of allowing sites silently.
4. Clear browsing data if pop-ups continue:
   • Chrome/Edge: Settings → Privacy and security → Clear browsing data
   • Firefox: Settings → Privacy & Security → Cookies and Site Data → Clear Data

Verify it worked: wait a few minutes and browse normally; you should no longer receive desktop pop-ups from unknown sites.

Extension is being forced by policy (a management rule) or another app

If this is your work device, stop here and contact your IT team before removing policies. A legitimate security tool may manage the browser.

1. Open the policy page:

chrome://policy

or

edge://policy

1. Look for extension-related entries such as:

ExtensionInstallForcelist
ExtensionSettings
HomepageLocation
DefaultSearchProviderEnabled

1. If this is your personal device and you do not expect management, remove the app that created the policy first using Settings → Apps → Installed apps.
2. Then restart the browser and check the policy page again.
3. If the browser still says it is managed and you are not comfortable editing system policy, escalate to your support team or an endpoint security tool for cleanup.

Verify it worked: the extension no longer shows Installed by enterprise policy, and the policy page no longer lists forced extension entries after restart.

A separate unwanted app on the computer keeps reinstalling the extension

1. Open installed apps and sort by recent install date.
2. Uninstall suspicious software you did not intend to install.
3. Reboot the computer.
4. Remove the browser extension again.
5. Run a security scan with your approved endpoint protection or built-in OS security tool.
   • Windows Security path: Start → Windows Security → Virus & threat protection → Scan options → Full scan
   • On managed work devices, use your organization's endpoint security tool or ask IT to run a scan.

⚠️ Do not uninstall software you recognize as business-critical without checking first. If the device is company-managed, ask IT before removing anything marked as security, VPN, device management, or remote support software.

Verify it worked: after reboot, the extension does not return, and the browser settings stay unchanged for a full work session.

Prevention

1. Limit extension installs to trusted publishers only

   • Before installing, open the extension details page and check the publisher name, review count, and permissions. If it asks to Read and change all your data on all websites, treat that as high risk unless the tool truly needs it.

2. Review extensions monthly

   • Use the browser's extensions page and remove anything unused.
   • A simple checklist to keep in your team docs:

- Do I still use this extension?
- Do I recognize the publisher?
- Does it need access to all sites?
- Was it installed recently before problems started?

1. Turn on click-to-allow notifications

   • In browser notification settings, choose the option that asks before allowing sites to send notifications. This reduces fake "allow to continue" prompts.

2. Use endpoint security to detect browser persistence

   • Ask your IT or security provider to alert on:

- New browser extensions installed
- Browser policy changes
- New startup/homepage/search provider changes
- Potentially unwanted applications (PUA/PUP) detections

1. Keep the browser updated

   • Browser menu → Help → About and let it update. Modern browsers block more malicious extensions and warn more clearly about risky permissions.

2. For managed fleets, pin an extension allowlist

   • If your organization manages devices, use your device management tool to allow only approved extensions and block force-installs from unknown sources. Review any policy that sets homepage or search provider so users can spot unauthorized changes quickly.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.