Chromebook virus: can a Chromebook get one and how to clean it
A "Chromebook virus" is almost never a virus in the Windows sense: Google says it knows of no documented, successful virus attack on ChromeOS, and what people actually meet are fake virus warnings, malicious browser extensions and unwanted apps. Each of them can be found and removed in a few minutes without any scanner, as the steps below show.
Facts checked October 5, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Do it yourself · free Remove Chromebook virus yourself 2 steps, about 6 minutes, no software needed.
Start the steps
Chromebook virus: summary
| Type | Not a virus in the Windows sense: fake warning pages, malicious browser extensions and unwanted apps on ChromeOS |
|---|---|
| Risk | Medium: the system is hard to infect; the risk is a scam call, stolen passwords and a hijacked browser |
| Symptoms | A page saying the Chromebook is locked or infected, with a phone number; a changed search engine or start page; redirects; an extension or app you did not add; high CPU load |
| How to get rid of it | Close the page, remove the extension or app, take back notification permission, reset the search engine; Powerwash only as a last resort |
| Our check (5 October 2026) | A desk check of Google's Chromebook, Chrome and Chromium documentation and published reports; no infected Chromebook was tested and no site was visited |
| First seen | 9 July 2020 (our first report); reader reports from April 2018 |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 6 more facts
| Installed on the PC | Nothing in the system: scam pages are web pages, and extensions or apps, if any, sit in the browser or the Launcher |
|---|---|
| Distribution | Ads, redirects and notifications that open fake warnings; extensions and apps added from a store or a page's prompt |
| Damage | Money paid to a fake support line, passwords and cookies read by an extension, a changed search engine |
| Name | Chromebook virus |
| Evidence | 3 reports from affected users; no sample analysed yet |
| Facts checked | 5 October 2026 |
Facts checked on 5 October 2026 against Google's Chromebook FAQ and help pages, the Chromium OS security overview, the FTC and two published reports on malicious extensions. We did not test an infected Chromebook and ran no site test, so the text says where an old claim could not be confirmed.
What people mean by "Chromebook virus"
A Chromebook virus is almost never a virus in the Windows sense. Google says it knows of no documented, successful virus attack on ChromeOS as of May 2025, so the name covers a scare page, a bad browser extension or an unwanted app.
- Usually it is
- A fake warning page that wants you to call or pay, a malicious or hijacked extension, or an unwanted Android app
- Usually it is not
- A program that installs itself into the system: the system partition is read-only and home folders cannot hold programs that run
- Where the damage sits
- In the browser profile (extensions, site permissions, search engine) and in the accounts you type into
- What fixes it
- Closing the page, removing the extension or app, taking back notification permission and, last of all, a Powerwash
The harm starts with a click: a page scares you, you call the number or install the "fix", and the caller or the add-on does the rest.
What the Chromebook virus message looks like
The wording as reported: a fake virus warning in a browser tab
YOUR COMPUTER HAS BEEN LOCKED!!
The work of your computer has been suspended.
Illegal access has been initiated from your system.
What the scare pages looked like, and what changed since 2020
April 2018 to May 2019
Readers write in about a hijacked Chromebook
Three readers wrote to our old page about Search Encrypt, a Yahoo redirect and a Jokerlivestream site. All three describe a changed browser, not a changed system.
June 2020
Malicious extensions reach millions of installs
The security firm Awake reported 111 malicious extensions in the Chrome Web Store with almost 33 million downloads. They copied screenshots, clipboard contents, login cookies and keystrokes, and Google removed them after being told.
July 2020
Our first report: three kinds of fake alert
The picture combined a fake "Scan for Viruses & Spyware!" page in a phone browser, an app dashboard reading "Your device has issues!" with a "Fix issues" button, and a browser dialog reading "YOUR COMPUTER HAS BEEN LOCKED!!" with a support phone line (hidden in the picture).
The fake alerts from our July 2020 report: a scan page, a "Fix issues" dashboard and a "computer locked" dialog. An illustration from 2020, not a screenshot of a hacked Chromebook. July 2025
Clean extensions turn bad after an update
Researchers described 18 extensions in the Chrome and Edge stores, with more than two million installs, that behaved normally and were switched to browser hijacking by an update. Chrome extensions work the same way on ChromeOS.
October 2026
What we could confirm
Google's Chromebook FAQ still says there is no evidence of a documented, successful virus attack on ChromeOS (as of May 2025), and we found none either. The documented harm is in the browser, in apps and in scams.
"My Chromebook was hacked!... I am now forced to use search encrypt... I would dearly love to go back to using good old regular Google or Bing"
"i am dealing with the Yahoo redirect virus... it keeps redirecting to yahoo. ive cleaned, deleted yahoo from saved engines, deleted all files title yahoo, but still it redirects to yahoo"
"How to remove Jokerlivestream from Chromebook?"
Readers' own words from our old page. See our guides to Search Encrypt and the Yahoo redirect.
How to tell the Chromebook virus message is fake
Is the warning real? How to tell a scare page from a real problem
A web page cannot scan your Chromebook, and the FTC says real security warnings never ask you to phone anyone.
| What you see | Real? | Why |
|---|---|---|
| A page says the Chromebook is infected, locked or "suspended" | Fake | A tab runs in a sandbox and cannot look through your files; the page only shows text. |
| A pop-up with a support phone number | Fake | The FTC: real security pop-ups and messages will never ask you to call a phone number. |
| A "Zeus virus" or other named-virus alert | Fake | The name only sounds serious; see our Zeus trojan detected scam guide. |
| An app or extension that appeared after a "fix" and says "Your device has issues" | Unwanted | Google says Chromebooks need no extra software, so a cleaner nobody asked for is the problem. |
| The search engine or start page changed | Real | A setting or an extension changed it. Check both. |
| "Managed by your organization" on a Chromebook you own | Check it | Chrome shows it when a management policy applies; on a home Chromebook, find out what set it. |
Such a page opens from an ad, a redirect or a notification you allowed earlier. Do not press OK, Fix issues or any scan button on it, because one click can open more; close the tab with its X or Ctrl + W.
How to check a Chromebook for a virus in ten minutes
ChromeOS has no virus scan button, and Google says no extra software is needed. The check is a look at four places: extensions, apps, permissions and settings.
- 1
Extensions
Select More (three dots) > Extensions > Manage extensions. Turn suspects off one at a time and test after each, as Google's reset guide suggests.
- 2
Apps
Scroll through the Launcher. Settings > Apps > Manage Google Play preferences exists only on Chromebooks that run Android apps; Linux is off by default.
- 3
Notifications
Open Settings > Privacy and security > Site settings > Notifications and read Allowed to send notifications (Stop website notifications and pop-ups).
- 4
Search engine and start page
In Settings check Search engine and On startup for anything you did not choose.
- 5
Managed browser and updates
At the bottom of the Chrome menu, "Managed by your organization" means a policy applies (
chrome://managementshows it). Then run Settings > About ChromeOS > Check for updates.
If all of it is clean, the warning you saw was only a web page. For one more layer, set Safe Browsing to Enhanced protection under Settings > Privacy and security > Security.
Is Chromebook virus dangerous? What the senders want
Can a Chromebook get a virus? What protects it and what does not
ChromeOS is hard to infect, which is why the trouble moved to the browser and to people. None of these protections stops you typing a password into a fake page or approving a bad extension.
| Protection | What it does | What it does not cover |
|---|---|---|
| Verified boot | Checks firmware, kernel and system files at start-up; a system changed by an attack is caught at the next reboot | Running code and the browser's own configuration, so a compromised browser can persist |
| Sandboxing | Each tab and app runs in its own confined area; all Linux apps share one sandbox | What you allow yourself: a typed password, a permission, an extension |
| Read-only system | A downloaded file cannot run as a program; home folders cannot hold executables | Android and Linux apps, which you install on purpose |
| Automatic updates | The Chromebook checks for updates when online; a restart finishes them | A model past its Auto Update Expiration date |
| Safe Browsing | Warns about dangerous sites, downloads and extensions | Anything when set to No protection; and extensions were removed only after outsiders reported them |
The old guide said "no executables can be installed" and that infections are "not possible". Both go too far: many Chromebooks run Android apps and, if you switch it on, Linux, and the browser takes extensions.
The real risks, from most to least serious
Money and passwords are at risk first. The Chromebook itself is usually easy to clean.
- High
Paying or giving remote access to a fake support line
The FTC describes it: a fake pop-up urges you to call, the caller asks for remote access, pretends to scan the computer, "finds" a program and asks for a fee, often in gift cards or cryptocurrency.
- High
A malicious or hijacked extension
An extension that reads your data on the sites you visit can take screenshots, the clipboard, login cookies and typed passwords, as the 2020 report showed. Bad extensions can also send you to tech support scam pages; they come from the Chrome Web Store, not Google Play.
- Medium
A fake sign-in page
The Chromium security overview says phishing is no more of an issue on Chromium OS than in Chromium browsers elsewhere, which also means no less.
- Medium
A rogue Android app
On Chromebooks that run Android apps, a fake antivirus, a crypto wallet or a tool that asks for odd permissions can ask for money or show ads. The old guide named wallet and mining apps on Google Play without saying which; we could not confirm a campaign aimed at Chromebooks.
- Low
A page or app that keeps the processor busy
The old guide listed mining apps and high CPU load as signs. We found no documented Chromebook case, and a heavy web page does the same.
What the 111 malicious extensions of 2020 collected
- Screenshots
- Clipboard contents
- Cookies that keep you logged in
- Keystrokes, including passwords
Awake's June 2020 report. An extension runs inside the browser, which is where you sign in to everything.
If you called the number or paid
Closing the page is enough if you only looked at it. If you phoned, let someone connect, paid or typed a password, do these as well.
- 1
Stop paying and stop talking
Hang up and do not call back, including for a "refund". If you paid, What to do after paying a scammer has the steps for a card, bank transfer, payment app, gift card or crypto.
- 2
Remove what the caller had you install
Remove any remote-access tool, "support" extension or app added during the call, from the Launcher or Manage extensions. On a work or school Chromebook, tell the administrator.
- 3
Change the passwords
The FTC says to change a password you gave a scammer right away, and everywhere you reused it. Start with the Google account, from another device if you can, and turn on two-step verification.
- 4
Report it
Ask your bank to watch or block the card. In the US report the call at ReportFraud.ftc.gov; other countries are listed in Report a cyber attack or scam to the authorities.
- 5
Powerwash if someone had remote access
If you cannot tell what the caller did, reset the Chromebook as described below, after saving your files.
What to do about Chromebook virus
Do not call the number in the message.
If you already called or let someone connect, follow every step.
Step 1: Stop replying and keep the evidence
Do not reply, pay, or send documents, even to "cancel" or "verify" something: every answer marks you as a target worth more messages. Take screenshots of the messages, the sender address, the phone numbers and any payment details, then block the sender.
If you already sent money or an ID document, the next steps cover what to do. The screenshots work the same on a phone or on Windows 11 and Windows 10, where Windows + Shift + S captures part of the screen.
Full procedure with screenshots: What to do after paying a scammer
Step 2: Report it
A report takes ten minutes and helps take Chromebook virus down.
Send it to ReportFraud.ftc.gov in the US (and ic3.gov when money was lost), to Action Fraud in the UK, or to your national police in the EU, with screenshots, sender details and any payment references.
Report the message inside the mail or chat app too. Keep a copy of everything until the case is closed, whether you use a phone or a Windows 11 or Windows 10 PC.
Full procedure with screenshots: Report a cyber attack or scam to the authorities
How to clean a Chromebook, step by step
Work in this order and test after each step. Most cases end at step 3.
- 1
Close the page
Close the tab with its X or Ctrl + W, and do not restore the tabs when Chrome offers to on the next start.
- 2
Remove the extension
Select More > Extensions > Manage extensions, press Remove under the extension and confirm; if its icon is on the toolbar, right-click it and choose Remove from Chrome (Remove a browser extension). Google's own advice is to approve only extensions you trust.
- 3
Uninstall the app
Right-click the app in the Launcher, choose Uninstall or Remove from Chrome, and confirm. It works for Chrome and Android apps alike; an app that will not go may be locked by a school or employer.
- 4
Take back notification permission
Under Settings > Privacy and security > Site settings > Notifications, remove sites you do not recognise from Allowed and add them under Not allowed.
- 5
Put the search engine and start page back
Set Search engine and On startup in Settings. If they change again, an extension is still installed: go back to step 2.
- 6
Update and restart
Run Check for updates in Settings > About ChromeOS, then restart.
No scanner is needed because no program sits in the system. If the problem returns, move to the Powerwash below.
Last resort: Powerwash the Chromebook
A Powerwash is Google's name for a factory reset. It erases everything stored on the Chromebook, so use it only when the steps above failed or someone had remote access.
- It erases
- All user data on the Chromebook's drive, including Downloads, settings, apps and extensions
- It keeps
- Files on Google Drive or an external drive
- You cannot do it
- On a work or school Chromebook; ask the administrator
- 1
Save what you need
Copy files from Downloads to Google Drive or an external drive and sync your settings to the Google account.
- 2
Start the reset
Sign out, press and hold Ctrl + Alt + Shift + R, select Restart, then Powerwash and Continue.
- 3
Set up again and check the extensions first
Sign in with your Google account; the first account becomes the owner account. If you sync extensions, the bad one may be restored by the sync. We could not find Google documentation on this, so open Manage extensions straight after signing in.
- 4
Add things back slowly
Install only what you need, one at a time. If the problem survives a Powerwash, Google lists recovering the operating system as the next step.
The old page called this a "recovery option that allows restoring everything to the earlier version". It does not: a Powerwash returns the Chromebook to factory state with the current system.
How to keep a Chromebook clean
Do
- Keep the Chromebook updated, and check its Auto Update Expiration date under Settings > About ChromeOS > Additional details.
- Install only the extensions and apps you need and read their permissions: a simple tool that wants to read and change all your data on every website is a warning sign. Reviews can be faked, and background activity is invisible.
- Choose Safe Browsing Enhanced protection in Settings > Privacy and security > Security.
- Keep a backup of important files on Google Drive or an external drive; a Powerwash leaves them alone.
Don't
- Do not call a number shown in a pop-up or on a web page.
- Do not install an "anti-malware" extension because a page or article says to: Google says no extra software is needed, and extensions are what attackers use.
- Do not press buttons on a warning page, including Close; close the tab.
- Do not install extensions or apps from outside the Chrome Web Store and Google Play, and do not give a caller remote access.
Questions about Chromebook virus
Can a Chromebook get a virus?
In the Windows sense, almost never. Google says it knows of no documented, successful virus attack on ChromeOS as of May 2025, and the system uses verified boot, sandboxing and a read-only system partition.
What does happen is fake warning pages, malicious extensions and unwanted Android apps, which cause harm without touching the operating system. Verified boot does not cover running code or a compromised browser, so the answer is hard to infect, not immune.
How do I check for viruses on a Chromebook?
There is no virus scan button, and Google says no extra software is needed. Check four places:
- the extension list under More > Extensions > Manage extensions
- the apps in the Launcher
- the sites allowed to send notifications
- the search engine and start page in Settings
Also look for "Managed by your organization" on a Chromebook you own. If all are clean, the warning was only a web page.
How do I get rid of a virus on a Chromebook?
Close the warning tab with Ctrl + W without pressing anything on it, then remove the cause:
- delete extensions you do not recognise
- uninstall unknown apps from the Launcher
- remove unfamiliar sites from the notification list
- put your search engine back
Check for updates and restart. If it returns, or someone had remote access, a Powerwash wipes the Chromebook, so save your files first.
Is there a malware scanner or antivirus for Chromebook?
There is no built-in scanner, and you do not need one: Google's Chromebook FAQ says no extra software is needed. Apps and extensions that promise to scan a Chromebook are themselves a risk, since unwanted add-ons often pose as security tools.
Safe Browsing set to Enhanced protection already warns about dangerous sites, downloads and extensions, and updates and few extensions do the rest.
How do I remove a virus extension from a Chromebook?
Open Chrome, select More > Extensions > Manage extensions, press Remove under the extension and confirm. If its icon is on the toolbar, right-click it and choose Remove from Chrome.
When you cannot tell which one is the cause, turn them off one at a time and test. On a work or school Chromebook the administrator may have installed it. Afterwards check the search engine and notification list.
Will a Powerwash remove malware from a Chromebook?
A Powerwash erases everything stored on the Chromebook, including settings, apps, extensions and Downloads, so it removes whatever lived there. Google Drive files stay. It is the last step because it also deletes your own files, and a work or school Chromebook cannot do it.
If you sync extensions, the bad one may return at sign-in, which we could not confirm from Google's documentation, so check the extension list afterwards.
Is the "Zeus virus" or "your computer has been locked" warning real?
No. A web page cannot scan a Chromebook, and the FTC says real security warnings never ask you to call a phone number. Text such as "YOUR COMPUTER HAS BEEN LOCKED" or a named virus belongs to a scare page that wants you to call, pay or install a fake cleaner.
Close the tab with Ctrl + W, press nothing on it, and check the notification list. If you already called or paid, follow the steps for callers above.
Why does my Chromebook keep redirecting to Yahoo or Search Encrypt?
An extension or a changed setting is sending the search there. Readers wrote to us about exactly this in 2018 and 2019, one forced onto Search Encrypt and one still sent to Yahoo after deleting it from the saved engines.
Deleting the engine is not enough, because the extension puts it back. Remove unfamiliar extensions under Manage extensions, then set the search engine in Settings and check On startup.
Can Android apps on a Chromebook carry malware?
They can be rogue or unwanted. On Chromebooks that run Android apps, a fake antivirus, crypto wallet or tool can ask for money or show ads, and the old guide named such apps on Google Play without saying which.
We could not confirm a campaign aimed at Chromebooks, so treat it as possible, not documented. Install only what you need and remove an app with a right-click in the Launcher.
Will Fortect remove Chromebook virus?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Chromebook virus, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Google Chromebooks: Questions about Chromebooks (no extra software needed; no documented successful virus attack, as of May 2025) (read October 5, 2026)
- Chromium OS design documents: Security Overview (verified boot, read-only root, what verified boot does not cover) (read October 5, 2026)
- Chromebook Help: Reset your Chromebook to factory settings (Powerwash) (no longer online) (read October 5, 2026)
- Chromebook Help: Uninstall apps or extensions (no longer online) (read October 5, 2026)
- Chrome Web Store Help: Install and manage extensions (no longer online) (read October 5, 2026)
- Chrome Help: Choose your Safe Browsing protection level in Chrome (no longer online) (read October 5, 2026)
- Chrome Help: Check if your Chrome browser is managed (no longer online) (read October 5, 2026)
- Chromebook Help: Update your Chromebook's operating system (no longer online) (read October 5, 2026)
- Google Play Help: Install and use Android apps on your Chromebook (no longer online) (read October 5, 2026)
- Chromebook Help: Set up Linux on your Chromebook (sandbox note) (no longer online) (read October 5, 2026)
- Chromebook Help: Chromebook keyboard shortcuts (no longer online) (read October 5, 2026)
- FTC Consumer Advice: How to spot, avoid and report tech support scams (read October 5, 2026)
- Ars Technica: Chrome extensions with 33 million downloads slurped sensitive user data (June 2020) (read October 5, 2026)
- Malwarebytes Labs: Millions of people spied on by malicious browser extensions in Chrome and Edge (July 2025) (read October 5, 2026)