Security & Privacy / Browser Security
How to Check Suspicious Browser Extensions in Windows
Quick answer
Open chrome://extensions or edge://extensions, remove extensions you do not recognize, and restart the browser. If the extension is managed by an organization, check whether this is a work/school profile. Do not install an adware cleaner from search ads just to remove one extension.
Quick diagnosis
If several of these match what you see, you are in the right guide.
- Search engine or homepage changed unexpectedly
- New popups, coupons, redirects, or notification spam
- Chrome or Edge becomes slow after an extension appears
- An extension says it can read or change every site
Possible causes
- A bundled extension installed with another program
- A malicious or abandoned extension
- Browser notification permission mistaken for malware
- A work/school extension policy
- A fake security popup pushing a browser add-on
What you need
- Chrome or Edge extension settings
- Windows Security
What this problem usually means
Extensions can read pages, change search settings, inject ads, or break sites. Suspicious does not always mean confirmed malware, but an extension you did not choose should not stay enabled.
Before you start
- Note whether the issue affects Chrome, Edge, or both.
- If a full-screen warning told you to install it, use fake Windows security warnings.
- Sync can reinstall extensions after sign-in; test before syncing again.
Quick fixes
1. Remove the extension
- Open chrome://extensions or edge://extensions.
- Turn off suspicious extensions first.
- If the browser improves, remove the extension.
- Restart the browser and test the same site again.
2. Clear notification spam
Browser notifications can look like infection popups. In site settings, remove notification permission from sites you do not recognize.
Step-by-step troubleshooting
Managed extensions
On work or school profiles, managed extensions may be intentional. On a personal PC, managed-by-organization messages can come from old policy or unwanted software. Remove suspicious desktop programs installed at the same time.
If the browser is slow or crashing
After removing unknown extensions, use the matching browser guide: Chrome slow, Chrome crashing, Edge slow, or Edge crashing.
Scan without panic
Run Windows Security from Start if popups continue after extension removal. Do not turn off browser protection to make a suspicious extension work.
Extension, notification, or browser problem?
Choose an answer. The next question appears below, no account or download required.
Check extensions, notifications, search engine, and homepage in that browser.
Check recently installed programs and run Windows Security from Start.
Ask IT before removing managed extensions or policy.
How to know the problem is fixed
- The unwanted extension is disabled or removed.
- Search/homepage stays correct after browser restart.
- The same sites load without popups or redirects.
If the problem continues
If extensions return after sync, pause sync, remove the extension from the browser account, and check recently installed programs. If fake warnings continue, use the fake-warning guide.
When this may be hardware failure
Browser extensions are software. Hardware is not the cause unless the browser problem is part of wider crashing, overheating, or storage corruption.
Common mistakes to avoid
- Installing a second cleanup tool from an ad.
- Leaving an extension enabled because its icon looks official.
- Disabling all browser security warnings permanently.
Frequently asked questions
Are all extensions dangerous?
No. The risk depends on permissions, publisher trust, behavior, and whether you intentionally installed it.
Why did it come back?
Browser sync, work policy, or another installed program may restore it. Remove the source, not only the visible extension.
Written by Practical PC editorial team. We write practical Windows and PC troubleshooting guides for home users, students, and office workers. Guides are researched from official documentation and widely observed support patterns, then reviewed for safety and plain language. We do not invent lab tests, certifications, or first-hand repair experience we do not have.