chrome_elf.dll: part of Google Chrome, another Chromium browser, or something you never installed?

What chrome_elf.dll does

Chromium's own documentation describes chrome_elf.dll as the Chrome Early Loading Framework: a way to run code very early during process start-up, before other imported DLLs such as kernel32. Chrome's entry point on Windows is the DllMain of chrome_elf.dll, and the build places it as the first import of chrome.exe. Running first lets the browser patch system functions that map libraries into the process, which gives it control over which outside DLLs can load into it.

The file also starts the crash reporter early, which is why programs built on the Chromium Embedded Framework ship chrome_elf.dll next to libcef.dll. Because all of this comes from open-source code, any browser built on Chromium carries a chrome_elf.dll of its own. The file is therefore no proof that Google Chrome is installed: the question is which browser's folder it sits in, and whether you chose that browser.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to check a copy of chrome_elf.dll

Four questions decide it: where the file is, which browser's files surround it, who signed it, and whether you installed that browser yourself. A library never shows in Task Manager under its own name, so use these checks.

1. List every copy and where it sits. Copies under Google\Chrome\Application\<version> are Chrome's. Copies in another browser's folder belong to that browser. Look closer at copies in Temp, Downloads, Public or an AppData folder with a name you do not recognise.

   Get-ChildItem -Path C:\ -Filter chrome_elf.dll -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime

2. Read the version resource. Chrome's copy reports Google LLC (or Google Inc.) as the company and Google Chrome as the description, with the Chrome version as file version. Another browser's copy names that browser. Empty fields deserve a closer look, but text fields can be copied, so they never clear a file alone.

   (Get-Item "C:\path\to\chrome_elf.dll").VersionInfo | Format-List CompanyName, FileDescription, FileVersion

3. Check the digital signature. Status Valid with a Google LLC signer means an unmodified Chrome build. A Chromium-based browser from a known maker is signed by that maker. NotSigned or HashMismatch means the file is not as its maker shipped it.

   Get-AuthenticodeSignature "C:\path\to\chrome_elf.dll" | Format-List Status, SignerCertificate

4. Find the browser it belongs to. Go one folder up from the version folder and look at the .exe there. Then open Settings, Apps, Installed apps and look for that browser. A browser you do not remember installing, especially one that appeared together with a free program, is the real finding, not the DLL.
5. Compare the size and checksum. Use the file check on this page. Google's builds in the catalogue range from about 120 KB to 1 MB. A match identifies a known copy; no match is not proof of a fake, because Chrome builds a new chrome_elf.dll for every version. The signature check above is the deciding one.

A valid signature clears that one file. It does not tell you whether you wanted the browser it came with, and a browser you never chose can change your search engine, start page and notifications with genuine, signed files.

Do you need chrome_elf.dll?

Keep every copy inside the browsers and programs you use: without it the browser does not start. A copy that belongs to a browser you never chose goes away with that browser, so remove the browser, not the DLL.

1. Leave Chrome's copy alone. A copy in Google\Chrome\Application belongs to Chrome. Deleting it only stops Chrome from starting; the browser's own installer is the way to replace one that is damaged or flagged.
2. Uninstall a Chromium-based browser you did not choose. Open Settings, Apps, Installed apps, find the browser and uninstall it. If it has no uninstaller and sits under AppData, close it in Task Manager first, then delete its whole folder, not only chrome_elf.dll.
3. Remove the program it came with. Sort Installed apps by install date. Unwanted browsers usually arrive with a free tool, converter or game installed on the same day. Uninstall what you do not recognise from that day.
4. Run a Microsoft Defender full scan. Open Windows Security, Virus and threat protection, Scan options, Full scan. Quarantine what it finds and look at Protection history afterwards for anything in Downloads, Temp or AppData.
5. Check what starts with Windows. Open Task Manager, Startup apps, and Task Scheduler. Disable entries that start a browser or an updater from AppData that you do not recognise, after the browser itself is gone.
6. Clean up the browser you keep. In the browser you use, check the default search engine, the start page, the extensions and the sites allowed to send notifications. Unwanted browsers and the installers that bring them often change these as well.

Warning signs

Known versions of chrome_elf.dll

A public DLL catalogue lists 170 versions of chrome_elf.dll, from 0.0.0.0 to 88.0.4285.3, by Google LLC. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix chrome_elf.dll errors on uGetFix

Questions people ask