Stop using the suspect Chrome session for passwords, payments and recovery codes. From a known-clean device, secure your accounts; then preserve evidence if the computer belongs to work or school, clean Chrome, update the operating system and scan for malware. A Chrome reset can remove unwanted browser settings, but it cannot prove that the computer itself is clean.
Do this first: contain the possible compromise
Treat a browser exploit as a potential credential and device-security incident until you have enough evidence to narrow it down. Do not sign in to more services in the affected Chrome profile, approve unexpected multifactor prompts, enter card numbers, or paste recovery codes into pages opened by that session.
As an Amazon Associate I earn from qualifying purchases.
- Move account recovery to a known-clean device. Use a phone or computer you trust, with current updates and no suspicious browser extensions. If you have no alternative device, stop using the affected browser for sensitive work until it has been assessed.
- Secure your primary Google account first. Change its password, review signed-in devices and active sessions, revoke anything unfamiliar, and complete Google Security Checkup. Remove unknown recovery email addresses, phone numbers or passkeys.
- Record what you observed. Write down the URL, warning text, date and time, new extensions, redirects, downloads, account alerts and any messages sent from your accounts that you did not write. Preserve screenshots and notification emails where possible.
- Do not wipe a high-value system yet. For a work, school or business computer, contact the administrator or incident-response team before shutting down, disconnecting or resetting it. Memory, running processes and other volatile evidence can disappear when a system is powered off or isolated.
- Stop the spread. If an account sent messages or shared files without your permission, warn recipients through a separate channel and revoke suspicious sessions before continuing with browser cleanup.
How to tell whether the problem is likely in Chrome, the computer or an account
One symptom is not proof of an exploit. A malicious advertisement, phishing page, unwanted extension, bundled software or a host-level infection can look similar. The pattern, timing and persistence matter.
Recommended Free Tools
Browser signs that justify investigation
- Virus or infection warnings that appear as browser pages, especially when they demand an immediate call, payment or download.
- Pop-ups or new tabs that continue after you close the original page.
- Extensions or toolbars you did not install, or that return after removal.
- Redirects to unfamiliar search, shopping or login pages.
- Your homepage or search engine changes without permission.
- Notifications from sites you do not recognize, including repeated “allow” prompts.
These signs can result from a bad extension or unwanted software rather than a successful browser exploit. They still warrant cleanup because the extension or software may read pages, alter downloads or capture what you type.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Device and account signs that raise the severity
- Security software is disabled, cannot update or repeatedly fails to run.
- The computer becomes unusually slow, runs hot, loses storage rapidly or malfunctions outside Chrome.
- Contacts receive messages you did not send, or your sent folder contains unfamiliar mail.
- Sign-in alerts show access from an unknown device or location, or recovery details have changed.
- The same behavior returns after Chrome is reset, extensions are removed and the operating system is updated.
Symptoms outside the browser, unauthorized account activity and repeated reinfection point toward a broader incident. Do not assume that removing a toolbar or resetting Chrome addresses those conditions.
Preserve evidence when investigation may matter
On a personal computer with no sign of account theft, you can usually document the symptoms and proceed with cleanup. Different rules apply to an employer-owned device, a school-managed computer, a server, a privileged administrator workstation or a machine containing valuable business or legal data.
Tell the responsible administrator what happened and follow the organization’s incident plan. Qualified responders may need browser history, extension files, system logs, memory, network records and backups. Immediate shutdown or disconnection can destroy volatile evidence and make it harder to determine what was accessed. Do not delete suspicious files, clear all history or run a destructive “cleanup” tool before you receive direction when a forensic investigation is possible.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If you already powered off the computer, report that fact and the time it happened. Do not restart it repeatedly or sign back into sensitive services while waiting for guidance.
Secure passwords and sessions from a clean device
When an exploit, malicious extension or malware may have been present, assume that passwords typed or stored in the affected Chrome profile could have been exposed. A browser password vault is useful, but it cannot protect a secret that malware was able to read while you were signed in.
- Change the main Google account password. Use a new, unique password that has never been used elsewhere. Review recent security events, signed-in devices and third-party access.
- Protect the recovery channel. Secure the email account and phone number used for password resets. Remove unfamiliar recovery methods and check whether forwarding rules or filters were added.
- Prioritize high-impact services. Change passwords for email, banking and payment services, password managers, work systems, cloud storage and social accounts. If the same password was reused, change every account that used it.
- Revoke active sessions. Sign out unknown browsers, phones and applications. Revoke unfamiliar OAuth or other third-party connections rather than merely changing the password.
- Inspect account activity. Check sent mail, deleted mail, forwarding settings, file-sharing links, payment activity and recent posts. Look for newly created app passwords, API keys or other access tokens.
- Turn on multifactor authentication. Prefer an authenticator app or a FIDO2 security key where the service supports it. A hardware key protects future sign-ins and account recovery, but it does not remove malware from the affected computer.
Do not change passwords inside the suspect Chrome session. If you must use the same physical computer, use a separate known-clean operating-system account only after an administrator or qualified responder says that is appropriate; a second browser profile is not a reliable security boundary on an infected host.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Run Chrome’s built-in checks and remove untrusted changes
Use Safety Check
In Chrome, open Settings → Privacy and security → Safety Check and complete every finding. Safety Check can review compromised, reused or weak passwords; Safe Browsing status; available Chrome updates; unwanted notification permissions; unused site permissions; and potentially harmful extensions. Treat its results as useful signals, not a guarantee that every exploit or malicious program has been found.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Audit extensions and permissions
Open More → Extensions. Remove anything you did not deliberately install, anything you no longer need and anything whose publisher or requested permissions you cannot explain. Pay particular attention to extensions that can read and change data on all websites, manage downloads or alter proxy settings. Review site permissions for camera, microphone, notifications and automatic downloads, and revoke access that is not necessary.
After a reset, Chrome can turn some extensions back on. Re-enable extensions one at a time, starting only with those you trust, and watch for the return of redirects, pop-ups or setting changes.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Update Chrome and the operating system
Go to Settings → Help → About Google Chrome, allow the update to install and restart when prompted. Then install pending security updates through the supported updater for Windows, macOS, Linux or ChromeOS. Browser and operating-system updates close different classes of vulnerabilities; updating only one leaves the other exposed.
Choose Safe Browsing deliberately
Chrome’s Safe Browsing settings offer different levels of protection. Enhanced Protection provides more proactive warnings than the standard setting, but it sends additional browsing information to Google. Choose it when stronger detection is worth that privacy trade-off, and make the choice knowingly rather than treating the setting as a malware-removal tool.
When to reset Chrome
If redirects, pop-ups or unauthorized homepage and search settings continue after removing extensions and updating, use Settings → Reset settings → Restore settings to their original defaults → Reset settings. A reset restores core browser settings; it does not erase every file on the computer, revoke stolen sessions or establish that the operating system is malware-free.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Before resetting, record extensions, bookmarks and settings you need to rebuild. Afterward, sign in only after account protection is complete, reinstall extensions selectively and avoid importing an old, untrusted profile wholesale. If the same symptom returns immediately, stop repeating resets and investigate the host or the account instead.
Scan the computer and decide whether a full reset is warranted
Run the reputable anti-malware and security scan supplied for your operating system, including its offline or boot-time option when available. Let it update before scanning. Review detections rather than blindly restoring quarantined files, and restart only as the security software instructs.
A full device reset is more disruptive than a Chrome reset: it removes applications and local data, requires reliable backups and can destroy evidence. Consider it, or obtain professional help, when security software is disabled, the operating system remains abnormal, reinfection continues, or you cannot establish what ran on the machine. For a managed device, follow the organization’s rebuild process rather than using the consumer reset button.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Choice | Use it when | What it does not solve |
|---|---|---|
| Chrome reset | Browser settings, redirects or unwanted extensions persist after basic cleanup. | Operating-system malware, stolen passwords, active sessions or evidence of data theft. |
| Operating-system reset or rebuild | Host-level compromise is plausible, symptoms persist outside Chrome, or trusted responders recommend rebuilding. | Accounts already accessed by an attacker; those still require password changes and session revocation. |
| Professional incident response | Work or privileged systems, suspected data theft, disabled security controls, repeated reinfection or forensic requirements. | It cannot undo exposure that has already occurred; containment and credential rotation remain necessary. |
When to escalate immediately
Contact your organization’s administrator, an incident-response provider or a qualified security professional without delaying for repeated browser resets when any of these apply:
- An administrator, finance, developer, email or other privileged account may have been used.
- There is evidence of unauthorized transfers, data theft, extortion, account takeover or messages sent in your name.
- The machine contains regulated, confidential or customer information.
- Security software was disabled, logs are missing or the infection returns after remediation.
- You need to preserve evidence for employment, legal, insurance or law-enforcement reasons.
Give the responder your timeline, screenshots, URLs, downloads, account alerts and the exact actions already taken. That information is more useful than a vague report that “Chrome was hacked.”
Prevent a repeat after recovery
- Keep Chrome and the operating system on their supported update channels and restart promptly when security updates require it.
- Install extensions only from sources you trust, keep the list short and review permissions after every update.
- Use Safe Browsing and treat urgent virus warnings, unexpected login pages and unsolicited downloads as untrusted until independently verified.
- Store unique passwords in a reputable password manager, enable multifactor authentication and keep recovery codes offline.
- Review Google Security Checkup and important account sessions periodically, not only after an alert.
- Maintain tested backups that are not continuously writable from the everyday user account.
The practical boundary is simple: clean the browser for browser symptoms, secure accounts from a clean device whenever exposure is plausible, and involve responders when the computer, data or evidence has higher value than a quick reset.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
