What to do if…
your browser homepage and default search engine change overnight

What to do now

1. Pause sensitive activity. Close tabs for email, banking, shopping, password managers, cloud storage, and work accounts. Use a different device, or a phone on mobile data, for anything urgent.

2. Check whether the browser is managed.

   • If you see “Managed by your organisation” and this is a work, school, college, or university device, stop and contact the IT or admin team.
   • If this is your personal device and you did not expect management controls, treat that as suspicious and continue with the steps below.

3. Remove suspicious browser extensions or add-ons.

   • Open the extensions or add-ons page in the affected browser.
   • Disable anything you do not recognise, especially tools described as search, coupon, PDF, new tab, security, assistant, shopping, or download helpers.
   • Remove the extension if you are confident you did not choose it or no longer need it.
   • Restart the browser and check whether the homepage, new tab page, and search engine stay put.

4. Reset or repair the affected browser where the browser supports it.

   • In Chrome, use Reset settings.
   • In Firefox, use Refresh Firefox.
   • In Microsoft Edge, remove unwanted extensions and check the homepage, startup page, and default search settings.
   • In Safari, check the homepage and extensions settings; remove extensions you did not choose.

5. Look for a recently installed app that may be forcing the change.

   • On Windows, open Installed apps or Apps & features, sort by recently installed, and uninstall unfamiliar apps from the last few days.
   • On macOS, check Applications for unfamiliar apps installed recently and remove only those you are confident are unwanted.
   • Be especially cautious with free installers, fake update tools, coupon tools, download managers, and “PDF” utilities.

6. Run a malware scan and update the device.

   • On Windows, run a scan using Windows Security.
   • On macOS, run any reputable security tool you already trust, if you use one.
   • Update the operating system and the affected browser before signing back into sensitive accounts.

7. Check browser sync before you reuse the browser.

   • If the browser syncs extensions or settings across devices, check whether the unwanted extension or setting has appeared on another device.
   • Remove the unwanted extension or setting from every synced device you control.
   • Do not sign back into browser sync on the affected browser until the unwanted changes have stopped.

8. Secure key accounts if you entered passwords after the change.

   • Start with your main email account, then banking, payment, password manager, work, cloud storage, and any account that reused the same password.
   • Change passwords from a clean browser or different device where possible.
   • Turn on two-step verification where it is available.

9. Report scam messages or fraud if relevant.

   • Forward suspicious emails to report@phishing.gov.uk.
   • Forward suspicious texts to 7726.
   • If money was lost, an account was taken over, or you installed something because of a scam, use Report Fraud if you are in England, Wales, or Northern Ireland.
   • If you are in Scotland, contact Police Scotland on 101 for non-emergency fraud or cyber crime reporting. Use 999 only for an emergency happening now.