STATUS_INVALID_IMAGE_HASH in Chrome, Edge and Brave: Antivirus DLL Block

STATUS_INVALID_IMAGE_HASH means Windows refused to load a file into your browser because its digital signature or hash did not check out. The most common reason is security software, an overlay or a utility trying to inject its own DLL into Chrome, Edge or Brave, which the browser's code integrity protection blocks. Update or remove the injecting program, then repair the browser, and the error usually disappears.

What the error actually tells you

The text STATUS_INVALID_IMAGE_HASH corresponds to the Windows status code 0xC0000428, which Windows uses when a file's signature cannot be verified for loading. In a Chromium browser, the renderer process runs with code integrity rules that allow only properly signed Microsoft or browser-vendor modules. Anything else that tries to attach itself to the process can be rejected, and the tab or the whole browser displays this status instead of the page.

That is a different story from a memory fault. For the memory case, where the tab touches an invalid address, see our STATUS_ACCESS_VIOLATION guide. This page is about files that were refused, which almost always means a third party is involved.

Cause table

Cause	How to recognise it	Fix section
Antivirus or web shield injecting a DLL	Started after an antivirus install, renewal or update	Steps 1 and 2
VPN, proxy or traffic-filter client	Error appears when the VPN client is running	Step 3
Overlay, capture or input utility	Appears in the browser when a game or recorder tool is open	Step 3
Corrupt or partially updated browser	Error remains with all third-party tools closed	Step 4
Unsigned or tampered file from an unwanted program	New toolbars, hijacked search page, odd extensions	Step 5
Damaged system files	Other signed apps also fail to start	Step 6

Why Edge and Brave show the same message

Edge and Brave are built on Chromium, so they inherit the same module-loading rules. A security product that hooks Chrome therefore tends to hook the others as well, which is why people with this error in one browser often see it in a second one after installing it. If Chrome fails but Firefox works, that is only a weak hint that the problem is specific to Chromium's module-loading rules. Treat it as a clue, not as proof.

Step 1: Confirm with a quick test of your security software

Open your antivirus and look for a web protection, browser shield, banking protection or "secure browser" feature. Turn that one feature off, not the whole antivirus, and restart the browser. If the error is gone, the DLL injection is confirmed. Switch the feature back on afterwards so you are not left unprotected, and move to step 2 for a permanent fix.

Windows Security on its own does not normally cause this. If you only use Microsoft Defender and see the error, jump to steps 4 to 6.

Step 2: Update the security product or switch off its browser hook

1. Install the vendor's latest program update. Many injection problems are fixed by a newer build that supports the current browser.
2. Check whether the product offers a setting such as "do not scan encrypted connections" or "disable browser extension", which stops the hook while keeping file protection on.
3. Look for a setting such as "browser protection", "secure browser" or "banking protection" and turn that feature off, or update the product. Do not exclude the whole browser from scanning unless the vendor's own instructions tell you to, because that lowers protection and does not by itself stop DLL injection. For reference, chrome.exe is usually under C:\Program Files\Google\Chrome\Application and Edge under C:\Program Files (x86)\Microsoft\Edge\Application, which helps when a vendor asks for the path.
4. Restart the PC, not only the browser, so the old hook is released.

Exact menu names differ between vendors, so we describe the idea rather than a single path. If you cannot find these options, the vendor's support site will list them for your version.

Step 3: Check VPNs, overlays and "helper" tools

Network filters, split-tunnel VPN clients, screen recorders, streaming overlays and mouse or keyboard utilities sometimes patch the browser to add features. When they fall out of date, Chromium blocks them. Close each one in turn, using the system tray, and reopen the browser. When the error stops after a certain program is closed, update it from the vendor's site. If the update does not help, run the browser without that tool, or look for an alternative.

Check Settings, Apps, Installed apps and sort by install date. The newest entries before the first error are the best suspects. Remove things you do not recognise, but only after confirming what they are.

Step 4: Repair the browser itself

Half-finished updates can leave a mix of old and new files. Updating over the top often repairs this:

1. Download the current installer from the browser maker's official site.
2. Run it over the existing installation. Your bookmarks, passwords and extensions remain in your profile folder.
3. Open chrome://version (Edge: edge://version) and confirm that the version number is the new one.

If it still fails, uninstall the browser from Settings, Apps, Installed apps, restart, and install it again. Leave the box "Also delete your browsing data" unticked. The User Data folder survives a normal uninstall unless you tick the box to delete it.

Find the blocked DLL in Event Viewer

Windows records the block. Press Windows + R, type eventvwr.msc, then open Applications and Services Logs, Microsoft, Windows, CodeIntegrity, Operational. Event ID 3033 names the DLL that was blocked and its path. The file name usually points straight at the product to update or remove, which is faster than guessing from the installed apps list. Write down the path before you change anything.

Step 5: Scan for unwanted software that tampers with the browser

An injected DLL is also how adware and browser hijackers work. Signs include a changed default search engine, extra toolbars, ads on pages that normally have none, and extensions you did not install. Run a full scan in Windows Security (Virus and threat protection, Scan options, Full scan) and, if you want a second opinion, the Microsoft Defender Offline scan. Then clear anything suspicious from chrome://extensions and from Installed apps.

If you see this after downloading a "free" tool, a cracked program or a video converter, assume it may be unwanted software and be thorough with the scan.

Step 6: Repair Windows system files

If other apps that are properly signed also fail, system files may be damaged. Open Command Prompt as administrator and run:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

Restart when both finish. If DISM reports an error code, our guides to error 0x800f081f and Windows Update problems explain the usual causes, because DISM relies on the same servicing components.

Edge and Brave specific notes

In Edge, check edge://extensions and also edge://settings/system for startup boost and background settings. Turning off "Startup boost" while testing makes sure the browser loads fresh instead of reusing a background process that already loaded an old module. Brave users often run extra privacy or VPN tools, so give Step 3 extra time.

On a work PC, security or monitoring software installed by your employer is a common source of the injected DLL. Ask your IT administrator to update or replace it. Browser policy no longer lets an administrator switch this protection off in current Chrome and Edge, so do not look for a setting to change.

What not to do

• Do not switch off Windows Security or your antivirus permanently. A short test is fine. A permanent change leaves the PC open to the same kind of injection you are trying to understand.
• Do not copy a DLL from another computer or a download site. That is exactly the kind of unsigned file that this error is built to stop.
• Do not use the --no-sandbox flag. It weakens the browser's isolation, and it is not a repair.
• Do not run a registry cleaner. It adds risk without addressing the cause.

When to call a pro

Call for help if the error returns after a clean browser install with every third-party tool closed, if Windows Security finds threats you cannot remove, if several signed programs fail together, or if you notice odd account activity after the problem began. Those signs suggest either malware or damaged Windows components, and fixing either one blindly can cost you data. We can inspect the machine in a remote session: see remote computer repair and our Windows support page. If an application also refuses to start with a different code, our 0xc000007b guide covers that cousin of this problem.

Keeping it from returning

• Run one security product at a time. Two active real-time scanners fight over the same browser hooks.
• After a major browser update, restart the PC, then check that the security software has also updated.
• Prefer security tools that work through documented browser extensions instead of deep injection, when you have the choice.
• Keep the list of installed apps short. Remove old VPN clients, capture tools and toolbars you no longer use.
• For another family member of this crash, read our STATUS_BREAKPOINT guide.

FAQ

What does STATUS_INVALID_IMAGE_HASH mean?

Windows could not verify the signature or hash of a file that the browser tried to load, so it blocked it. The error is tied to code integrity rules, and in practice it points to a third-party module.

Is my antivirus causing STATUS_INVALID_IMAGE_HASH?

It is the most common cause in our experience. Turn off only the web or browser protection feature for a test. If the error stops, update the antivirus or adjust that feature.

Does this happen on Brave and Edge as well as Chrome?

Yes, because all three use Chromium. If a hook affects one, it often affects the others.

Can malware cause it?

Yes. Unwanted software that injects code can trigger the block. Run a full Windows Security scan, and review extensions and installed apps for anything you did not choose.

Will reinstalling Chrome delete my bookmarks?

A normal uninstall keeps your profile data, but sign in to sync first so you have a copy online. Do not tick the option to delete browsing data unless you have a backup.

Is STATUS_INVALID_IMAGE_HASH the same as STATUS_ACCESS_VIOLATION?

No. Access violation is a memory fault, while invalid image hash is a signature check on a file being loaded. The fixes overlap only a little.

Why did it start after a Windows update?

A Windows or browser update can make an older security hook incompatible. Update the third-party software, then restart the PC.