PanicStation.org
UK USA
us Technology & digital loss

What to do if…
your browser homepage and default search engine change overnight

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy USA guide

Short answer

Treat the browser as untrusted for now. Stop sensitive logins in that browser, remove unknown extensions and apps, reset the browser, run a malware scan, and secure important accounts if you may have typed passwords while it was affected.

Do not do these things

  • Don’t sign in to banking, email, tax, healthcare, crypto, or password-manager accounts in the affected browser until you have cleaned it.
  • Don’t install “browser cleaner”, “support”, “security scan”, or “fix my search” tools from pop-ups or unfamiliar download sites.
  • Don’t call phone numbers shown in pop-ups, search redirects, or fake security warnings.
  • Don’t click “Allow” on notification prompts from unfamiliar sites.
  • Don’t keep changing the homepage and search engine repeatedly if they change back; something may be enforcing the change.
  • Don’t remove workplace, school, or security-management settings on a device you do not fully control.

What to do now

  1. Stop using the affected browser for sensitive accounts. Close it. If you need to log in somewhere important, use a different device, or use a different browser only if it is not showing the same problem.

  2. Check whether the setting is being enforced.

    • If the browser says “Managed by your organization” on a work or school device, contact the IT or device administrator.
    • If it says this on a personal device and you did not expect it, do not delete device-management profiles or security software at random. Continue with the extension, app, reset, and scan steps below, and get trusted technical help if the message remains.

  3. Remove suspicious extensions or add-ons.

    • Open the browser’s extensions or add-ons page.
    • Disable anything you do not recognize, especially extensions described as search, new tab, coupon, PDF, shopping, security, assistant, video, download, or toolbar tools.
    • Remove the unknown extensions after disabling them.
    • Restart the browser and check whether the homepage or search engine changes back.

  4. Reset or refresh the affected browser.

    • Chrome: use Reset settings to restore the original defaults.
    • Firefox: use Refresh Firefox.
    • Safari on Mac: open Safari > Settings, then check Extensions, Search, and General. Remove unknown extensions, choose your search engine, and set the homepage you want.

  5. Remove the app that may have installed the change.

    • Windows: open installed apps and uninstall unfamiliar apps that appeared around the time the homepage or search engine changed.
    • Mac: check Applications for unfamiliar apps. In Safari, some extensions are removed by deleting the app that contains the extension.
    • Be especially cautious with recently installed free utilities, PDF tools, download managers, coupon tools, browser toolbars, and fake security tools.

  6. Run a malware scan and update the device.

    • On Windows, run Windows Security, including a full scan if available.
    • Run any reputable security tool you already trust and keep installed.
    • Update your operating system and browsers.
    • Do not install a scanner from a pop-up or from the hijacked search results.

  7. Secure accounts if passwords may have been exposed.

    • If you typed passwords while the browser was redirecting searches or showing strange pages, change your email password first, then financial and other high-value accounts.
    • Change reused passwords on any other accounts that use the same password.
    • Turn on multi-factor authentication where available.
    • Do password changes from a clean browser or another device when possible.

  8. Report it if there was fraud, theft, account takeover, or a scam path.

    • Use the Federal Trade Commission’s ReportFraud site for scams, fraud, or money loss.
    • Use the FBI Internet Crime Complaint Center if this involved cyber-enabled crime, account takeover, theft, fraud, or similar cybercrime.

What can wait

  • You do not need to prove exactly which extension or app caused it before you take the first cleanup steps.
  • You do not need to wipe the computer immediately if removing extensions and apps, resetting the browser, scanning, and updating stop the problem.
  • You do not need to decide now whether to replace the device, change every account, or contact every company you use.
  • You do not need to answer pop-ups, surveys, support chats, or warning pages connected to the changed homepage or search results.

Important reassurance

A sudden homepage or search-engine change is often caused by an unwanted extension or bundled app. Acting calmly, stopping sensitive browser use, removing what is controlling the browser, and securing key accounts usually reduces the immediate risk.

Scope note

These are first steps only. If the change comes back, if more than one browser is affected, if accounts show suspicious activity, or if money was lost, you may need specialist technical support, account recovery help, or official reporting.

Important note

This is general information, not professional cybersecurity, legal, financial, or identity-theft advice. Follow official account-recovery and reporting instructions for any account, bank, workplace, school, or service involved.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us