Browser hijacking
In plain terms
Your home page, your search engine, and your tabs are no longer the ones you chose. You reset them, and they come back: something keeps rewriting them.
Definition
Browser hijacking is the persistent modification of browser settings — home page, search engine, new tab page, extensions — by software installed on the device, in order to redirect browsing.
How it works
The installation almost always comes from an installer that was offering something else, with a pre-checked box. The program then modifies the browser's settings, and above all reinstalls itself: a scheduled task, a service, or a second extension restores what you just corrected, which explains the feeling that the change comes back on its own. The goal is rarely direct theft. It's about capturing search: every query passes through an intermediary that displays its own sponsored results, which is worth money, and incidentally exposes you to booby-trapped ads. Hijacking is therefore both the most visible problem in this family and one of the most persistent.
Warning signs
- Default search engine replaced, and restored on its own after being fixed
- Unfamiliar home page or new-tab page
- Searches passing through an intermediary before reaching the results
- Extensions you didn't install, reappearing after removal
- Toolbar added to the browser
- Inability to change certain settings, shown as managed by an organization
How to verify
Check three places, in this order: extensions, search and startup settings, then programs recently installed on the system. The third is the one people forget, and it's often the one reinstalling the first two. Also check the browser's shortcut targets, which may have been modified to add an address at launch.
What to do
Refuse pre-checked options during installations, and download from the publisher rather than an aggregator. This hijacking rarely installs itself alone: it rides along with something else you wanted.
If it already happened
Uninstall the responsible program at the system level before fixing the browser, or the fix will be undone. Then remove unknown extensions, restore settings, check shortcut targets, and run a scan. Change your passwords if browsing was redirected over an extended period.
Frequently asked questions
- I reset my search engine and it changes again.
- That's the signature of this problem: a component is reinstalling the setting. Look on the system side — installed programs, scheduled tasks — rather than in the browser, which is only where the symptom shows up.
- Is reinstalling the browser enough?
- No, if the responsible program stays on the machine: it will reconfigure the new installation. The correct order is to remove the cause at the system level, then restore the browser.
Related attacks
Official sources
This article is part of the Website and browser attacks family. Last updated: 2026-09-02.