How to fix STATUS_INVALID_IMAGE_HASH error in Chrome or Edge?

STATUS_INVALID_IMAGE_HASH means Windows refused to load a code file into a Chrome or Edge tab because the file failed a signature check. That file almost always belongs to another program, most often security software. Find which program it is and update it or exclude the browser from it.

Facts checked on 15 October 2026. Steps written for Steps read against Windows 11 25H2 and Windows 10 22H2 with current Chrome and Edge. The crash page itself was not reproduced by us; its text is quoted from the old guide's screenshot and from Broadcom's knowledge base..

What STATUS_INVALID_IMAGE_HASH means in Chrome and Edge

Chrome and Edge show web pages in separate tab processes, which Google and Microsoft call renderer processes. Since version 78 both browsers start these processes with Renderer Code Integrity turned on. Windows then checks every code file that tries to load into the tab and refuses one whose signature does not pass.

STATUS_INVALID_IMAGE_HASH is the Windows status code for that refusal: the hash of the file (the "image") could not be matched to a valid signature. The browser cannot keep a tab running after such a failure, so it shows the crash page with the code at the bottom.

What causes STATUS_INVALID_IMAGE_HASH, from most to least likely

Google publishes no numbers for this error. The order below follows how the error is produced and what the vendors document. Each cause points to one fix.

How to fix STATUS_INVALID_IMAGE_HASH in Chrome or Edge

Fix 1 tells you which program causes the crash, and Fix 2 and Fix 3 deal with it. Fix 4 is a two-minute update of the browser. Fix 5 and Fix 6 find and remove the program when the log names nothing. Fix 7 and Fix 8 cover damaged browser files and malware.

Fix 1. Read which file Windows blocked in the Code Integrity log

3 minutesNo riskEveryone, before changing anything: it often names the program in one minute.

Code Integrity is a Windows feature, not a Chrome one, and Windows keeps its own log of what it checked. A blocked load names the browser process and the path of the file that failed, and the folder of that file tells you which program it belongs to.

1. Open Chrome or Edge and let the tab crash once, so a fresh entry is written.
2. Right-click Start and select Event Viewer.
3. In the left pane, open Applications and Services Logs > Microsoft > Windows > CodeIntegrity > Operational.
4. In the middle pane, select the newest entries from the minute of the crash.
5. Look for an entry that names chrome.exe or msedge.exe and a second file path, usually a .dll.
6. Write down the folder of that file, for example a folder under C:\Program Files\ named after a security product.

Fix 2. Update the antivirus or endpoint protection program

5 to 15 minutesLow riskA third-party security program is installed, or the log names its folder.

The vendors fix this by signing the file they put into browsers, or by no longer loading it there. Broadcom did exactly that for Symantec Endpoint Protection in version 14.2 RU2 MP1. A current version of the product is the clean way out.

1. Open the security program from its icon in the notification area or from Start.
2. Find Update, Check for updates or About and install every program update, not only the virus definitions.
3. Restart Windows when the program asks, and also when it does not.
4. Open Chrome or Edge and load two or three sites.
5. If no newer version is offered, check the vendor's support site for the product's current release and install it over the old one.

Symantec Endpoint Protection

Fixed in 14.2 RU2 MP1, build 14.2.5569.2100, per Broadcom. Older builds crash Chrome and Edge 78 and later.

Other products

We found no vendor statement with a version number. Install the newest release and test.

Work PCs

The update is usually pushed by IT. Go to Fix 3.

Fix 3. Add an exception for chrome.exe and msedge.exe, or ask IT for one

5 minutesLow riskThe security product cannot be updated, or it is managed by your employer or school.

Broadcom's workaround for Symantec is an Application Control exception for Chrome.exe and MSEdge.exe. The exception stops the product from injecting into the browser, so Code Integrity has nothing to refuse.

1. Open the security program's settings and find the module that hooks into apps: names like Application Control, Exploit protection, Behavior monitoring or Application rules.
2. Add an exception for Chrome: C:\Program Files\Google\Chrome\Application\chrome.exe.
3. Add an exception for Edge: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.
4. Save, close every browser window and open the browser again.
5. On a work or school PC, send IT the file path from Fix 1 and the error code instead, and ask for the exception or an updated agent.

Fix 4. Update Chrome or Edge and restart Windows

5 minutesNo riskThe error started after a browser or Windows update, or you want to rule out an old build.

A restart reloads the security product's drivers in a clean state, and a current browser is the version vendors test against. Restarting also ends background browser processes that keep the old state.

1. In Chrome, type chrome://settings/help in the address bar and press Enter. In Edge, type edge://settings/help.
2. Wait while the browser checks for updates, then select Relaunch.
3. If the Settings page crashes too, download the current Chrome from Google's site and run it over the installed copy. For Edge, use Fix 7.
4. Select Start > Power > Restart. Do not use Shut down, which can keep parts of the old session with Fast Startup.

Fix 5. Find the program with a clean boot

15 to 30 minutesLow riskFix 1 named nothing, or you have several background tools and do not know which one to blame.

A clean boot starts Windows with only Microsoft's services. If Chrome or Edge works then, one of the third-party services or startup apps injects into the browser, and turning them back on in halves finds it.

Step by step: How to perform a clean boot in Windows. Test the browser after every restart.

1. Open System Configuration. Select Search on the taskbar, type msconfig and select System Configuration from the results.
2. Hide Microsoft services. On the Services tab, select the Hide all Microsoft services check box. Only services from other companies stay in the list.

   

3. Disable the remaining services. Select Disable all, then select Apply.
4. Open Task Manager. On the Startup tab of System Configuration, select Open Task Manager.

   

5. Disable the startup apps. On the Startup apps tab in Task Manager, select each item whose status is Enabled and select Disable. Write down or take a screenshot of the items you disable: you need the list to turn them back on.

   

6. Confirm the changes. Close Task Manager. On the Startup tab of System Configuration, select OK.
7. Restart and test. Restart the PC. Windows now starts in a clean boot environment: try again the thing that failed (run the app, install the update, uninstall the program).

These steps were written for Windows 11 25H2 and 26H2. The full page with the other versions and what each result means: How to perform a clean boot in Windows

Fix 6. Remove the third-party security program and let Microsoft Defender take over

10 minutesLow riskYour own PC, the program is already up to date, and an exception did not help.

Removing the program removes the file it injects. Microsoft Defender Antivirus turns on by itself when no other antivirus is registered, so the PC stays protected.

Step by step: Uninstall a program or app in Windows. Many vendors also offer a removal tool for leftovers; use the one from the product's own support site.

1. Uninstall from the Start menu. Select Start > All apps and find the app. Right-click it (or press and hold) and select Uninstall.
2. Or uninstall in Settings. Select Start > Settings > Apps > Installed apps. Find the app, select More (the three dots) > Uninstall, and confirm.
3. Or uninstall from Control Panel. Some programs can only be removed here. Type Control Panel in the search box on the taskbar and open it, then select Programs > Programs and Features. Right-click the program and select Uninstall or Uninstall/Change, then follow the program's own uninstaller.
4. Restart if the uninstaller asks. Some programs finish removing their files only after a restart.

These steps were written for Windows 11 24H2 and 25H2. The full page with the other versions and what each result means: Uninstall a program or app in Windows

• After the restart, open Windows Security > Virus & threat protection and check that real-time protection is on.
• Open Chrome or Edge and test several sites.
• If the crash is gone, reinstall the newest version of the product only if you need it, and test again at once.

Fix 7. Repair Edge or reinstall Chrome

10 minutesLow riskOnly one browser fails, or the log names a file inside the browser's own folder.

A browser file damaged on disk also fails its hash check. A repair or a fresh install puts back signed copies of every file.

1. Edge: press Win + I, open Apps > Installed apps and find Microsoft Edge.
2. Select the three dots next to it (on Windows 10, select the entry), then Modify, and confirm the prompt.
3. Select Repair and wait while Edge is downloaded and installed again.
4. Chrome: in Apps > Installed apps, select the three dots next to Google Chrome and Uninstall.
5. In Chrome's uninstall box, leave Also delete your browsing data unchecked if you want to keep your profile.
6. Download Chrome from Google's site, install it and restart Windows.

Fix 8. Scan for malware that injects into browsers

15 minutes to 2 hoursNo riskThe log names a file in a folder you do not recognise, or the browser also shows ads or a changed start page.

Adware and banking trojans push their own unsigned files into browsers. Code Integrity then blocks them, and the crash is the visible sign.

Step by step: How to scan for malware with Microsoft Defender. Run a full scan, not only a quick scan.

1. Open Windows Security. Select Start, type Windows Security and open the app.
2. Open Virus & threat protection. Select Virus & threat protection. Under Current threats you see when the last scan ran, how long it took and how many files it checked.
3. Run a quick scan. Select Quick scan. If Windows Security thinks a deeper scan is needed, it tells you when the quick scan is done.
4. Open Scan options. If the quick scan finds nothing and you still suspect an infection, select Scan options under Current threats.
5. Run a full scan. Select Full scan and start it. It checks every file and program on the device, so it takes much longer than a quick scan. Leave the PC on until it ends.
6. Or scan one folder. To check only a download or a USB drive, select Custom scan in Scan options and choose the folder. You can also right-click a file or folder in File Explorer and select Scan with Microsoft Defender. On Windows 11 you may have to select Show more options first.
7. Read Protection history. Go back to the first page of Windows Security and select Protection history. Select a card to expand it and see the details.

These steps were written for Windows 11 25H2 and 26H2, Windows 10 22H2. The full page with the other versions and what each result means: How to scan for malware with Microsoft Defender

Chrome or Edge still shows STATUS_INVALID_IMAGE_HASH: what to check and who can help

If the crash survives all fixes, collect what Windows recorded and give it to the people who can change the injecting program.

1. In Event Viewer, right-click the CodeIntegrity entry from Fix 1 and select Copy > Copy Details as Text.
2. Note the browser version from chrome://settings/help or edge://settings/help, or from Apps > Installed apps if those pages crash.
3. Note the name and version of every security, VPN and parental control program on the PC.
4. Check whether the browser says Managed by your organization at the bottom of its menu.

How to stop STATUS_INVALID_IMAGE_HASH from coming back

Frequently asked questions

What does Error code: STATUS_INVALID_IMAGE_HASH mean?

It means Windows refused to load a code file into a Chrome or Edge tab because its hash did not match a valid signature. Both browsers run tabs with Renderer Code Integrity since version 78, which lets Windows reject such files. The file usually comes from another program, most often an antivirus or endpoint protection product that hooks into browsers. The tab cannot run without it, so you see the crash page. Fix 1 shows how to read which file was blocked.

Does the RendererCodeIntegrityEnabled registry fix still work?

No. Google's policy list says the policy was supported in Chrome 78 to 117, removed in Chrome 118 and ignored if set. Microsoft's Edge policy page says it is obsolete after Edge 118 and ignored from 119. Many older guides, including the old version of this page, still give the REG ADD command. On a current browser it changes nothing. If you added the value earlier, you can delete it from HKLM\Software\Policies\Google\Chrome or HKLM\Software\Policies\Microsoft\Edge.

Should I use the --no-sandbox switch to fix it?

No. The switch turns off the sandbox that keeps a hostile web page away from the rest of your PC, for every site you visit. Chrome shows a warning bar when it runs with it, saying that stability and security will suffer. Even when the crash goes away, the cause is still there. Find the program that injects into the browser with Fix 1 and update or exclude it instead.

Why does Edge show the same error as Chrome?

Because Edge is built on Chromium, the same engine as Chrome, and uses the same tab process design and the same Renderer Code Integrity. A program that injects into both browsers breaks both. Broadcom's article lists Chrome 78 and later and Edge 78 and later for the Symantec case. When only Edge fails and Chrome works, the injecting program may target Edge alone, or Edge's files may be damaged, which Fix 7 repairs.

Why can I not even open Chrome's settings?

Chrome's own pages, such as Settings and History, also run in tab processes. When a program injects into every tab process, those pages crash the same way as websites. That is why the fixes here do not depend on Chrome's settings: Event Viewer, the security program, a clean boot and Installed apps all work outside the browser. To update Chrome without its Settings, install the current version from Google's site over the old one.

Can an extension cause STATUS_INVALID_IMAGE_HASH?

We found no vendor source that links this code to browser extensions. Extensions run inside Chrome's own extension system and do not load Windows code files into the tab. The old advice to remove extensions is dropped for that reason. A desktop program that installed an extension along with its own files can still be the cause, through its files, not through the extension. Fix 1 shows which program it is.

Will clearing the cache or using compatibility mode help?

Not for this code. The cache holds web content, not code files that load into the tab, so clearing it leaves the blocked file in place. Compatibility mode changes how Windows starts the browser, not which programs inject into it, and it can cause other problems in a modern browser. Both methods came from the old version of this page and are dropped. Start with Fix 1 instead.

Chrome does not start at all. Is it the same problem?

Not always. STATUS_INVALID_IMAGE_HASH shows inside a Chrome window, on the crash page of a tab, so Chrome itself starts. If no window appears at all, the cause is different: a stuck background process, a damaged profile or an install problem. Check Task Manager for chrome.exe processes, end them and start Chrome again. If Chrome opens but every tab crashes with this code, the fixes on this page apply.

Is No image hash supplied the same error?

No. That text is not the crash code of Chrome or Edge, and we could not find it documented as a browser message. It usually comes from developer tools or image tools that expect a hash value. This page is only about STATUS_INVALID_IMAGE_HASH, the code on Chrome's Aw, Snap! page and Edge's problem page.

Is STATUS_INVALID_IMAGE_HASH a virus?

Not by itself. In most documented cases the blocked file belongs to a legitimate security product. Still, malware that injects into browsers also produces unsigned files that Windows refuses. If the file in the Code Integrity log sits in a folder you do not recognise, or the browser also shows ads you did not see before, run a full Microsoft Defender scan as in Fix 8.