You click a blank area of a page and a new window appears. Or Chrome shows a fake update warning, sends you through two unfamiliar domains, or keeps putting notifications on your screen after you thought pop-ups were blocked. The fix depends on what actually opened.
Google says Chrome blocks pop-ups by default. Start by checking that default and removing site exceptions. If the behavior continues, treat notifications, redirects, and extensions as separate suspects. A recent r/chrome report described a fake update prompt that downloaded a .vbs file and was later traced to an extension. That is a useful warning, not a reason to assume every pop-up is malware.
Tabbit Browser can keep the official help page, the affected site, and your notes in one workspace while you investigate. It cannot change Chrome's permission settings or decide whether a domain is safe.
Key takeaways
Chrome's default Pop-ups and redirects setting should stay on block.
A site exception can survive after the original task is over, so review and remove old entries.
Notifications are separate from pop-ups. Redirects and fake alerts need a different check.
Do not click a fake update, run a downloaded script, or turn off Safe Browsing to make a page quieter.
Tabbit helps you compare sources and keep the investigation together. The actual block still belongs to Chrome or a dedicated security tool.
What you are seeing determines the first move
| Symptom | First safe action | What not to assume |
|---|---|---|
| A new tab opens after a click | Check Pop-ups and redirects and site exceptions | Blocking one site blocks every ad format |
| Alerts appear near the desktop clock | Review Notifications for that site | They are controlled by the pop-up toggle |
| The address changes through unfamiliar domains | Close it and verify the final domain | The first visible brand name proves the destination |
| A page says Chrome is infected or needs an urgent update | Do not download or run anything | A browser-looking design is an official warning |
| The behavior stops when extensions are disabled | Remove or investigate the responsible extension | Chrome's built-in blocker caused the alert |
Block pop-ups and redirects on a computer
Open Chrome and select the three-dot menu.
Choose Settings.
Select Privacy and security, then Site settings.
Open Pop-ups and redirects.
Choose the option that does not allow sites to send pop-ups or use redirects.
Those labels come from Google's Chrome Help instructions. Chrome already uses blocking as the default, but a site can have a separate permission. In the same settings area, inspect sites that are allowed to send pop-ups and remove entries you no longer recognize.
If one legitimate site stopped working, do not switch the global setting off. Follow How to allow pop-ups in Chrome for sites you trust, add only the verified site, finish the task, and remove the exception when you are done. Payment providers, identity providers, and document viewers sometimes open a second window. That is a reason to verify the domain, not to allow every site.
Android and iPhone have different control surfaces
On Android, open Chrome's menu, go to Settings, then Site settings, and review Pop-ups and redirects. The exact labels can move between Chrome releases. Google's Android help page is the reference for the version on your phone.
iPhone and iPad do not expose every desktop Chrome control. Review the current Chrome Help page for iPhone and iPad and the iOS permissions that apply to the device. If the problem is a family safety rule, use the device or account control that owns the restriction rather than trying to recreate it inside one browser.
| Device or situation | Start here | Boundary |
|---|---|---|
| Personal Windows or Mac computer | Chrome Site settings | A different profile or browser may have different permissions |
| Personal Android phone | Chrome Site settings | VPN, another browser, or another account can change the path |
| iPhone or iPad | Chrome plus iOS controls | Desktop Chrome instructions do not all map to iOS |
| Work or school device | Ask the administrator | A managed policy can override your setting |
Pop-ups, notifications, and redirects are not interchangeable
A pop-up is a new window or tab opened by a page action. A redirect changes the navigation target. A notification is a permission-based alert that can appear outside the current page. Chrome handles these through different controls.
If the page is closed but alerts keep appearing, open the site information control beside the address, find Notifications, and set it to Block. Google's notification guidance documents the same distinction. Clearing cookies may remove some site state, but it does not replace a permission review. If you need that cleanup, see how to clear Chrome's cache and how to delete Chrome cookies.
Redirects need a domain check. A page can begin on a familiar site and end somewhere else. A Reddit user described a search that “re directed me to yahoo” and said the pop-ups stopped after disabling a random extension (thread). The report does not identify the cause for everyone, but it shows why the final URL matters.
When an extension is the real source
Chrome's built-in blocker is not the only code that can change page behavior. Extensions can inject scripts, open their own windows, rewrite search, or show an alert that resembles a browser message. In another r/chrome thread, the author found the issue came from an extension that displayed a fake update prompt.
Use this order:
Do not click the suspicious prompt or run its download.
Open
chrome://extensionsin a new tab.Disable extensions you do not need, starting with anything installed shortly before the behavior began.
Reopen the affected page and test once.
Remove the extension if the behavior stops and you do not have a verified reason to keep it.
Review the publisher, permissions, and recent reviews before installing a replacement from the Chrome Web Store. The store is a distribution channel, not a guarantee that a blocker is harmless or complete. Our guide to browser extension troubleshooting covers permission and compatibility checks. If the symptoms include search hijacking or repeated warnings, see Chrome's guidance on unwanted ads, pop-ups, and malware.
Keep Safe Browsing on
Pop-up blocking and site safety are related, but they are not the same setting. Google's Safe Browsing documentation lists Standard protection as the default and Enhanced protection as a stronger option. It says Safe Browsing warns about malware, phishing, abusive sites and extensions, intrusive ads, and social engineering.
Do not choose No protection just because a page says the warning is inconvenient. If Chrome shows an unsafe-site warning, read Google's warning guidance, leave the page when the destination is unclear, and check whether the connection is secure before entering a password or payment details. A lock icon does not make an unknown site trustworthy, but an unexpected domain is a reason to stop.
A practical research workflow with Tabbit Browser
Browser troubleshooting gets messy when the relevant evidence is spread across a support page, a site you do not fully trust, extension settings, and a Reddit report. Tabbit Browser is useful for that research stage.
Open the Chrome Help page, the service's own support page, and a note containing only the domains you saw. Use Chat with Page to extract the official setting path, then compare it with the service's instructions. Keep the suspicious page in a separate tab group. If there are too many sources, organize browser tabs or use Smart Tab Organization to keep the investigation readable.
Tabbit can summarize the rule and help you record a rollback step. Agent Mode can assist with ordinary research tasks, but it should not be given passwords, card details, or permission to approve an unknown download. It does not remove Chrome extensions or make a redirect safe. For a wider explanation of browser actions, see browser automation; for a product-level overview, read what an AI browser is. If you migrate your research setup, back up browser data first.
Use the narrowest fix that solves the problem
Keep Chrome's default block enabled. Reset a site exception if the unwanted windows belong to one domain. Block notifications separately when alerts continue after the page closes. Inspect extensions when the behavior follows you across sites or browsers. Treat redirects and fake updates as a security question, not a settings annoyance.
There is one important exception: a known payment, sign-in, or document flow may need a new window. Verify its domain through the service's own documentation, then use the trusted-site allow guide and remove the rule afterward. A broad allow-list creates more noise than it solves.
FAQ
Chrome's built-in block is a good starting point, but it is only one layer. If the issue survives the setting, check the kind of event, the site permission, the extension list, and the destination domain in that order.
When you need to compare the official instructions with the pages involved, install Tabbit Browser. Keep the evidence together, and make the final permission or download decision yourself.
FAQ
How do I block pop-ups in Chrome on a computer?
Open Chrome Settings, choose Privacy and security, Site settings, then Pop-ups and redirects. Select the option that blocks sites from sending pop-ups or using redirects. Chrome blocks pop-ups by default, so first check whether a site-specific exception exists.
Why do pop-ups still appear after I block them?
The window may be a notification, a redirect, or behavior caused by an extension rather than a Chrome pop-up. Review the site's notification permission, inspect unfamiliar extensions, and check the final URL before downloading or signing in.
Are Chrome pop-ups and notifications the same thing?
No. A pop-up opens a new window or tab, while a notification is an alert sent after a site receives notification permission. Blocking pop-ups does not revoke notification permission.
Can I block pop-ups in Chrome on Android or iPhone?
Chrome exposes different controls on mobile. On Android, open Chrome Settings and Site settings to review Pop-ups and redirects. On iPhone and iPad, use the current Chrome controls and iOS settings available on the device; do not assume the desktop allow-list or reset path exists.
Should I block every pop-up, including sign-in and payment windows?
Keep blocking on by default, but a trusted checkout, identity provider, or document viewer may need a site-specific exception. Verify the destination through the service's own documentation, and use the separate guide on allowing pop-ups for sites you trust before adding a narrow rule.
What should I do about a fake Chrome update pop-up?
Do not click Update or run a downloaded script. Close the page, review recently installed extensions, remove anything you do not trust, and follow Chrome's unsafe-site and Safe Browsing guidance. If you entered credentials or ran a file, use your normal account and device incident process.