How to scan Chrome for viruses and remove them permanently

The term “Chrome virus” is a rather misleading term. A Chrome virus isn’t a virus coming directly from Google Chrome. Rather, it’s malware or a virus that directly attacks the Chrome browser. A 2026 campaign by Socket found over 100 malicious browser extensions on the Chrome Web Store, some of them with over 20,000 user downloads.

Read on to find out what types of malware can affect browsers and how to identify and remove malware from Chrome.

Can Chrome get a virus or malware infection?

Yes, just like any piece of software, Chrome can be exploited through unpatched flaws, malicious links, or infected websites. However, one of the biggest infection risks comes in the form of user-downloaded browser extensions. Many of these are disguised as productivity or security tools, typically ones that request access to your browsing data.

But a browser extension doesn’t need to be malicious to be dangerous. 60% of Chrome extensions haven’t been updated in over 12 months, leaving them more vulnerable to third-party exploits. This means an estimated 350 million users run what security researchers dub “security-noteworthy extensions.”

Chrome malware generally falls into 3 categories:

• Site-delivered malware: Threats are delivered from compromised pages as adware or drive-by downloads.sual suspects when it comes to attacking browsers like Chrome.
• Browser hijackers: These redirect your search engine and install extensions.
• Sideloaded extensions: They bypass Google’s review by being installed from outside the official Web Store.

Can Google Chrome extensions be malware or contain viruses?

Google Chrome extensions can contain malware but not viruses. There is a marked difference between malware and viruses. Viruses are designed to spread to other computers, while other types of malware remain on the target computer.

A malicious Chrome extension, therefore, falls more under the category of malware since it works on the target computer, collecting and stealing data. It isn’t looking for another place to jump to.

In particular, keep an eye out for permission warnings when installing a new extension. If Chrome warns you that the extension can “Read and change all your data on all websites,” it means the extension will have access to everything on every page you visit, including content, inputs, and cookies. Legitimate extensions sometimes need access to content, but most of them don’t.

In general, extensions in the Chrome Web Store are free from malware due to Google’s rigorous screening process. You’re only likely to encounter a rogue extension if you download and install it from outside the Chrome Web Store (a process known as sideloading). The logical conclusion is to confine your extension installations to the Chrome Web Store.

How to tell if your Chrome is infected with malware

So, how do you know if Chrome is infected with malware? If we assume that the culprit is a browser hijacker, which it likely is, then here are the usual symptoms.

Your browser slows down

Chrome malware hogs resources, so anything that affects the browser is going to seriously put the brakes on your online browsing. If you suddenly find the browser unresponsive or struggling to speed up, then something could be in the background pulling the strings.

Your CPU, memory, and data usage spike

Another way that malware affects your browser speed is in the amount of CPU and memory it consumes.

Taking root inside your MacBook and beginning to steal and transfer your data takes up a lot of CPU and memory, as well as a lot of internet data.

Your MacBook battery and Wi-Fi connection die on you

All of this heavy lifting is also going to do a number on your laptop battery, which will drain very quickly. It will cause your device to overheat and perhaps eventually crash, requiring a reboot.

Since the malware relies on your Wi-Fi connection to move out the stolen data, it may put an intolerable strain on your Wi-Fi network. It will begin to slow down and may crash constantly.

Fake virus alerts caused by browser notification permissions

Malicious or compromised websites might trick you into clicking “Allow” on a notification prompt, usually disguised as location or push-notification access. If you approve it, the scareware will flood your Mac with fake system-style virus warnings, even after you close the tab.

These aren’t warnings about real infections; they’re spam, and you shouldn’t engage with them.

Unexpected “Managed by your organization” messages

If Chrome shows a message saying “Managed by your organization” on a personal device that isn’t for work or school, it’s likely that enterprise policies have been silently installed on your Mac, silently controlling your settings.

Your browser settings are changed

Browser hijackers waste no time in changing your browser settings. You may notice that the following has been changed:

1. Your homepage
2. Your default search engine
3. Your startup pages
4. Your browser security settings (downgraded or disabled)

You notice new extensions appearing

Browser malware could also install new extensions without your permission, such as one to redirect you to other sites and search engines.

You’re redirected to other websites and search engines

Speaking of which, if you do a search on Google and suddenly find yourself on another search engine, a browser hijacker is likely to blame.

The same goes for if you try to visit a site but get redirected to other unwanted websites.

You can’t install browser patches

Browser malware can also prevent you from installing security patches. If you find that downloading patches has become slow and/or disrupted, consider it a red flag that should be investigated.

How to remove malware from Chrome

If you think Chrome has malware, such as a browser hijacker, here are the steps to decisively remove it for good.

The first step is to confirm or deny the existence of malware by running a Chrome virus scan on your Mac. For this, we recommend using Moonlock antivirus.

Moonlock is a lightweight, fast, and powerful platform that was created to deal with situations like removing browser hijackers.

Even if you already have an anti-malware tool, malware often disables virus notifications, so take nothing for granted. No news isn’t always good news.

The first step is to sign up for your free trial and then install the app. Once that’s all done, open it up and prepare for action:

1. When you open Moonlock, you’ll see 5 different options in the left-hand sidebar. One of them is Malware Scanner. This is the malware removal tool. Select it.
2. Before letting Moonlock loose on the malware in Chrome, you need to choose the scan mode. Deep scan will guarantee that no byte on your Mac is left unchecked.
3. Now it’s time to click the Scan button. Moonlock will scour the depths of your Mac and scan Chrome for malware. It may even find other threats you weren’t aware of.
4. If any threats are found, Moonlock will neutralize them and show them to you. Select them all and click Remove.

Update Chrome to the latest version

In addition to new features, updates also patch security vulnerabilities that malware can exploit. So it’s important to always have the latest version of Chrome running:

1. Open Chrome.
2. Click on the 3 vertical dots menu, then select Help.
3. In the new menu, click on About Google Chrome.
4. Under About Chrome, wait for it to auto-update if it wasn’t already up to date.
5. Click Relaunch.

Remove suspicious extensions

Regularly check the extensions installed in your browser and remove anything suspicious or that you no longer use:

1. Open Chrome.
2. Type chrome://extensions in the address bar.
3. Click Remove on suspicious extensions.
4. Click Remove in the pop-up window to confirm.

Reset Chrome to its default settings

If the symptoms of malware or a browser hijacker persist, you might need to reset Chrome to its default settings:

1. Open Chrome.
2. In the address bar, type chrome://settings/reset.
3. Click “Restore settings to their original defaults.”
4. In the pop-up window, click “Reset settings.”

Unwanted search engines added to your Chrome

Unwanted search engines are one of the biggest signs of a browser hijacker changing your settings. You’ll need to manually remove any unwanted search engines added to Chrome:

1. Open Chrome.
2. Type chrome://settings/search in the address bar.
3. Under “Default search engine,” click Change.
4. In the pop-up window, select your preferred search engine.
5. Click “Set as default.”

Clear notification permissions

Fake virus alerts are usually caused by browser notifications sent by compromised or malicious websites. Here’s what to do:

1. Open Chrome.
2. Go to chrome://settings/content/notifications in the address bar.
3. Scroll down to “Allowed to send notifications.”
4. Click on the 3 vertical dots next to any site you don’t recognize.
5. From the pop-up menu, click Block.

Remove suspicious programs

Sometimes symptoms of a browser hijacker aren’t caused by a malicious browser extension but by suspicious software installed directly on your Mac. This is especially the case if it has access permissions, allowing it to keep adding extensions to your Chrome and changing its settings.

You’ll need to investigate and remove it at the OS level:

• Most apps are stored in the Applications folder.
• Select the suspicious or unwanted app.
• From the Finder menu bar, click File, then Move to Trash.

Even after fully cleaning your device, it’s difficult to tell how far-spread the Chrome malware was. To be on the safe side, if you entered any passwords or payment details while Chrome was behaving suspiciously, immediately change them from a different device. 

You might need to contact your bank and keep an eye on login attempts and card payments for a few weeks after the fact.

Wipe all cookies

When Moonlock has dealt with the malware, there may still be cookies storing data about websites you visited, your browser preferences and settings. This data can be misused again by malware, so it’s better to clean it up and start your Chrome session fresh.

To perform a clean sweep, try CleanMyMac. It will remove cookies and other junk files, making your Mac as good as new.

Will uninstalling Chrome get rid of malware?

Uninstalling Chrome will not necessarily get rid of malware on Chrome. As we stated in the previous section, there may be related files, with scripts, sitting on your Mac. If so, reinstalling Chrome will merely start those files up again.

It’s also possible that your browser sync features may put some of the malware settings inside your sync files. These will then sync back once Chrome is reinstalled and you sign into your Google account.

How did malware end up in your Chrome browser?

In your post-infection analysis, you’ll have to determine how the malware got onto your machine in the first place. Otherwise, what’s to stop you from repeating the same mistake and going through the ordeal again? 

Instead of a direct attack, you might want to investigate the possibility of phishing. Websites, emails, and messages that seem legitimate might’ve tricked you into clicking on a link or downloading a file that turned out to be Chrome malware.

You could have gotten malware if you did any of the following:

• Downloaded email attachments
• Received a call from someone claiming to be IT support, who then asked you to install remote access software
• Attached an unknown USB device or other external drive to your Mac
• Installed extensions and/or apps from outside the Chrome or Mac ecosystems
• Bought a new piece of legitimate software that contained trojan malware

To avoid falling for similar phishing attacks in the future, use Scam Detector to double-check the legitimacy of web pages and requests, even ones sent from friends or colleagues. Here’s how to use it:

• Sign up for a 7-day free trial of Moonlock.
• Open Moonlock, then click on Scam Detector from the left-hand sidebar.
• Copy and paste the suspicious message into the detector.
• Click Check.

If Moonlock suspects the message to be a scam in disguise, it’ll warn you against engaging with it and provide actionable steps and advice on what to do next.

You may have gotten malware if you did any of the following:

• Downloaded email attachments
• Received a call from someone claiming to be IT support, who then asked you to install remote access software
• Attached an unknown USB device or other external drive to your Mac
• Installed extensions and/or apps from outside the Chrome or Mac ecosystems
• Bought a piece of legitimate software that contained trojan malware

How to secure Chrome and avoid malware infections in the future

Let’s finish off by giving you a checklist of security precautions that will greatly reduce your chances of malware on Chrome.

Don’t click links or download attachments from unsolicited emails

Email is the preferred method of attack for many hackers and criminals. It’s cheap and easy to send out to potential victims, and there will always be someone who falls for it.

If you get any kind of link or email attachment from a stranger or someone you barely know, don’t click it.

Always keep your browser and device updated

Browser updates come out on a regular basis. You can check for new ones by clicking Chrome > About Google Chrome. Always install new updates quickly.

The same goes for your MacBook in general. Always install new updates as soon as they come out. You can find them by going to System Settings > General > Software Update.

Turn on Chrome’s Enhanced Protection mode

Chrome has its own built-in security measures that can help you stay safe while browsing. Enhanced Protection allows Chrome to check malicious sites, downloads, and extensions in real time. Here’s how to turn it on:

1. Open Chrome.
2. Go to chrome://settings/security in the address bar.
3. Under Safe Browsing, select “Enhanced protection.”
4. You’ll get a notification stating “Enhanced protection is on.”

Review notification permissions regularly

Sites can continue sending you notifications indefinitely after you’ve given them permission once, sometimes by accident. It’s best that you regularly review Chrome’s notification permissions to remove anything you no longer use:

1. Open Chrome.
2. Go to chrome://settings/content/notifications.
3. Review the list of websites under “Allowed to send notifications.”
4. Remove anything you no longer use or trust.

Keep Real-Time Protection enabled

With your 7-day free trial of Moonlock, you’ll get to use its built-in Real-Time Protection feature. This monitors your Mac around the clock, ensuring that you don’t download anything malicious by accident. To enable this feature:

1. Open Moonlock. Then, from the Homepage, click Explore.
2. From the right-hand sidebar, under Real-Time Protection, click Options.
3. In the pop-up window, under “Continuous monitoring,” tick the box for “Turn on Real-Time Protection.”

Always install extensions from the Chrome Web Store

As we’ve explained, the Chrome web store is doing a better job these days of vetting and screening all extensions in their store. If anyone asks you to install an extension from outside the web store, don’t do it. Just because you can doesn’t mean you should.

Don’t install any remote access software if asked

If you get a phone call from “IT Support” claiming that your computer is infected, and they ask you to install remote access software, don’t do it. Simply hang up the phone.

This is a classic hacker’s trick. Once you grant someone access to your device, they can wreak havoc, steal data, and place malware wherever they please.

Don’t attach unknown USB drives

Finally, if you find a USB drive lying around, you might be tempted to see what’s on it. But this would be a mistake.

USB drives are sometimes left lying around by hackers who are hoping that you’ll do precisely that. Needless to say, the drives are infected with malware.

Malware on Chrome should not be ignored or dismissed as a mere nuisance. It has the potential to do serious harm if left unchecked. In addition to stealing your data, it can also sell your browsing information to third parties and infect your machine with more malware.

Follow the instructions and advice in this article, and you’ll stay safe from Chrome malware.

This is an independent publication, and it has not been authorized, sponsored, or otherwise approved by Google LLC. Google Chrome and Google Web Store are trademarks of Google LLC.