Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/S-PScripts/chromebook-utilities/llms.txt

Use this file to discover all available pages before exploring further.

Managed Chromebooks commonly disable both incognito mode and guest browsing so that administrator-controlled extensions remain active at all times. Incognito mode matters because Chrome’s managed extensions are loaded into the regular profile but not into incognito windows, meaning filters and monitoring extensions cease to function there. Guest mode provides a completely separate, unmanaged browsing session. The exploits on this page span many ChromeOS versions — from a 2020-era captive portal trick all the way to the v131 guest mode bypass — so check the version requirement on each method before attempting it.
Using personal Google accounts on a school-managed device may be against your school’s Acceptable Use Policy. Some methods below (OOBESCAPE, Sh1ttyOOBE) involve partial unenrollment. Understand what each method does before proceeding.

​
Incognito Mode Exploits

Requires ChromeOS v81 or lower. This exploit opens incognito during the sign-in flow before managed policies have fully loaded.Benefits of this incognito window:
  • No extensions — nothing is blocked by an extension
  • Fully unrestricted YouTube access
  • Can sign into other Google accounts if blocked
  • Access to most chrome:// URLs blocked by policy
  • Can bypass some policy-blocked sites
  • Access to chrome://flags for further experimentation
Possible issues:
  • Importing an ONC file may crash the session
  • Do not navigate to chrome://os-settings or open Settings from incognito
  • Restarting to apply flags will close the tab (effects still apply after restart)
  • Installing extensions (unpacked or CRX) shows “not allowed on login screen”
1

Reach the new-user sign-in screen

On the login screen, navigate to the part where you are signing in as a new user.
2

Enter credentials but do not log in

Enter your email and password, but do not click Sign in.
3

Open privacy policy overlay

Press Alt+Shift+I to open the privacy policy overlay.
4

Spam the overlay

Spam the privacy policy popup for approximately 30 seconds to 1 minute until the page becomes very laggy.
5

Log in and immediately open incognito

After logging in, quickly navigate to an incognito tab with Ctrl+Shift+N.
6

Switch to desktop view

Press the Switch/Desktop View key and close the original incognito tab.
7

Dismiss policy pages

If policy pages keep opening, repeat the desktop view switch (Step 6) as needed.
Credits: Luphoria, Titanium Network
Requires ChromeOS v105 (patched on later versions). This exploit uses a captive portal DNS to trigger a sign-in notification that contains a Browse Incognito button.IP addresses (use in Name Servers):
150.136.163.0  (current/primary)
158.101.114.159
129.213.58.41
52.207.185.90
158.111.114.159
1

Open Wi-Fi settings

Go to Settings, click the Wi-Fi network name, click it again, then go to the Network section.
2

Set custom DNS

Scroll to Name servers, change the option to Custom Name Servers, and paste 150.136.163.0 into all boxes.
3

Click the portal notification

A notification should appear saying Open a new tab. Click it — this opens a small captive portal window.
4

Click Browse Incognito

In the portal window, click the Browse Incognito button.
5

Restore DNS

Return to network settings and set Name servers back to Automatic.
If the popup does not appear, try again. If you close the incognito tab, you must repeat all steps from the beginning.
Sign-in screen (WebView) variant:
  1. Sign out of your Chromebook.
  2. On the sign-in screen, click the settings button in the top-right of the Wi-Fi panel.
  3. Go to Name servers and set them to 150.136.163.0.
  4. Disconnect and reconnect 1–3 times if the DNS does not save.
  5. A Visit this network’s sign-in page link will appear in the district login window.
  6. Click the link, then on the black background page, click the Webview link for tests.
  7. You will have an unblocked Google search page.
Credits: NotGamerFromGamerTown#8823, Quartinal, Brandon421-ops
Requires ChromeOS v123–v127. Relies on the chrome://flags/#captive-portal-popup-window flag. Found via crbug.com/341245382.Full write-up: https://s-pscripts.github.io/incognito-v123/Requirements:
  • Access to chrome://flags
  • ChromeOS v123–v127
1

Enable the captive portal flag

Navigate to chrome://flags/#captive-portal-popup-window, enable the flag, and restart. If the flag resets after restart, this method will not work on your device.
2

(v126–v127 only) Enable the temporary unexpire flag

  • On v126: go to chrome://flags#temporary-unexpire-flags-m124 and enable it, then restart.
  • On v127: go to chrome://flags/#temporary-unexpire-flags-m125 and enable it, then restart. Then proceed back to Step 1.
3

Trigger a captive portal (Option 1 — custom DNS)

Go to Settings → Network → Wi-Fi → your network → Network. Set Name servers to Custom name servers and enter one of these in the first box:
detectportal.firefox.com
captive.apple.com
150.136.163.0
A sign-in popup should appear from your Wi-Fi. Click Sign in.
4

Open incognito from the popup

Press Ctrl+T inside the captive portal popup — you are now in an incognito tab. You can also right-click the top of the tab and choose Show as tab.
5

Restore DNS

Set Name servers back to Automatic and reconnect to your Wi-Fi.
Option 2 (EE Wi-Fi, UK only): Connect to EE Wi-Fi. When the sign-in popup appears, click Sign in, then press Ctrl+T.
You can use CAUB to enable custom DNS/Name Server changes if policies restrict them.
Credits: cohen (crbug original), s0urce-c0de, S-PScripts, Brandon421-ops
Requires ChromeOS v128. Very buggy — may not work on your device. Three methods available.Full write-up: https://s-pscripts.github.io/incognito-v128/Requirements:
  • Access to chrome://flags
  • ChromeOS v128
Method A (Custom DNS):
1

Enable the captive portal flag

Go to chrome://flags/#captive-portal-popup-window, enable it, and restart.
2

Set DNS to trigger the portal

In Wi-Fi settings, set Custom name servers to 150.136.163.0 in all boxes. Click Sign in when the popup appears.
3

Wait for the portal to load

Wait for the white screen to clear — a black background with red borders and a yellow button should appear.
4

Click the webview link

Click the blue Webview link for tests text.
5

Restore DNS

Change Name servers back to Automatic. Disconnect and reconnect to Wi-Fi.
6

Wait for Google

Wait a minute for Google to load. You have successfully completed the exploit.
Method C (Task Manager):
1

Enable unexpire and captive portal flags

Go to chrome://flags, find the temporarily unexpire flag V126 and enable it, restart. Then go back and enable the captive portal flag and restart again.
2

Use any DNS to get a captive portal

Use 150.136.163.0 as a custom name server. When the captive portal page appears, open Task Manager.
3

Kill the incognito tab

In Task Manager, find Incognito tab, click it, and click End process.
4

Navigate within the dead portal

Go back to Wi-Fi settings and restore your DNS. Return to the now-dead captive portal page and click the blue Learn more button.
5

Navigate to Google

Go to the Privacy and Policy page, scroll to the bottom, and click the Google logo at the bottom left.
Credits: S-PScripts, brandonprather4930 (Method C)
Requires ChromeOS v129–v131. Despite the name, this does not produce an actual incognito window — it crashes the browser. Mostly a novelty.Requirements:
  • Access to chrome://flags
  • ChromeOS v129–v131
1

Enable toolbar pinning

Go to chrome://flags, enable the toolbar pinning flag, and restart.
2

Open Customize Chrome

Click the three-dots menu at the top right → More tools → Customize Chrome.
3

Enable New Incognito Window in toolbar

In the sidebar that appears, click Toolbar, then in the Navigation section enable New incognito window.
4

Click the incognito icon

Click the incognito icon that appears in the top-right toolbar.
5

Observe the crash

The browser will crash. That’s the exploit.
Credits: S-PScripts

​
Guest Mode Exploits

Patched on ChromeOS v131. Access guest mode during the post-powerwash setup flow by using a captive portal DNS at the Welcome screen.
1

Powerwash the Chromebook

Press Ctrl+Alt+Shift+R on the sign-in screen, or use Esc+Refresh+Power to enter Recovery Mode, then press Ctrl+D followed by Enter. Alternatively, try Ctrl+Alt+Q+Q on the sign-in screen.
2

Connect to Wi-Fi with custom DNS

At the Welcome screen after the powerwash, connect to Wi-Fi. Click the network name, scroll to Custom Name Servers, and change the first box to 150.136.163.0. Leave the other fields as they are.
3

Disconnect and reconnect

Disconnect from the network, reconnect, and close any popup that appears.
4

Access Guest Mode

Continue through the setup prompts. When a Guest Mode option appears on the left side, click it.
After entering Guest Mode, improve internet performance by setting Custom Name Servers back to Automatic in settings. To exit Guest Mode, click the bottom-right Quick Settings area and select Exit Guest Mode. Timing may vary — repeat the steps if the Guest Mode option does not appear.
Credits: aetr, Titanium Network, Brandonius (brandonprather4930), Hack Hive
Up to ChromeOS v130. Uses a captive portal Wi-Fi network during first-time setup to expose the Guest Mode link.
1

Powerwash your Chromebook

Perform a powerwash to reach the first-time setup screen.
2

Connect to a captive portal network

During setup, select a Wi-Fi network that opens a captive portal (e.g., a coffee shop or airport-style hotspot).
3

Wait for the portal popup

Your Chromebook may get stuck on a loading screen for up to 5 minutes. Wait for a captive portal popup that has a URL bar at the top. It must be the one with the URL bar visible.
4

Right-click the URL

Click the URL in the popup once to highlight it, then right-click it once. The screen may turn black for a few seconds.
5

Close the portal and access Guest Mode

Close the portal window. In the network list, a small link should appear that opens Guest Mode. Click it.
Credits: no-name-6655, ext-remover discussion #1247
Specifically for ChromeOS v131. Uses a null DNS address during setup to expose the Browse as Guest option.
1

Powerwash your Chromebook

Perform a powerwash.
2

Connect to Wi-Fi with null DNS

Connect to any accessible Wi-Fi network and set all DNS fields to 0.0.0.0. Custom DNS servers must not be managed by policy for this exploit to work.
3

Disconnect and reconnect

Disconnect and reconnect to Wi-Fi.
4

Attempt to add another network

Click Get Started and find Add other Wi-Fi network. Click it, type random characters, and attempt to connect.
5

Reconnect to original Wi-Fi

Connect back to the original Wi-Fi. If a Google loading screen appears, press Shift+Alt+S, click the power icon, and click Restart.
6

Wait for Guest Mode option

After the Chromebook turns on, wait. The Browse as Guest option should appear on the left side. If it does not, repeat all steps from the beginning (or powerwash and start over).
Credits: .eliasy, Titanium Network, Brandonius (brandonprather4930), Hack Hive

​
Account Access

Requires ChromeOS r130 or lower. This method uses DAUB (developer mode) and murkmod’s pollen.json policy to enable multi-user sign-in, then allows switching between personal and school accounts.
1

Downgrade ChromeOS

Downgrade to r130 or any version below it (r105 recommended but showing age).
2

Perform DAUB

Complete the DAUB (developer mode unlock) process.
3

Set GBB flags

Set GBB flags to 0x80b1.
4

Enter developer mode

Go to developer mode.
5

Apply the pollen policy

Enter VT2 with Ctrl+Alt+→, log in as root, and run:
mkdir -p /etc/opt/chrome/policies/managed
curl -SLk https://raw.githubusercontent.com/rainestorme/murkmod/refs/heads/main/pollen.json -o /etc/opt/chrome/policies/managed/policy.json
6

Refresh policies

Return to Chrome with Ctrl+Alt+←, navigate to chrome://policy, and press Refresh policies.
7

Add your school account

Log out of your personal Gmail account and add your school account.
8

Switch back to personal account

Once the school account is added, log out and return to your personal Gmail account.
9

Sign in another user

Click the Quick Settings area (time/Wi-Fi/battery), press the arrow next to the power button in the menu, click your email, then Sign in another user.
10

Sign in to school account

Sign in to your school account. Switch between accounts with Ctrl+Alt+. (period).
If your school sets ChromeOsMultiProfileUserBehavior to unrestricted in policies, you can skip to Step 7. If you have fakemurk or murkmod already installed, you can also skip to Step 7 (unless on r131+).
Credits: kxtzownsu (kxtz)
Add a personal Gmail or Google account to Chrome on your school Chromebook by manipulating cookie permissions. This adds the account to the browser (not the device OS).Prerequisites: Ability to modify cookie settings from the browser’s site information panel.
1

Go to Google and open cookie settings

Navigate to https://google.com/. Click the two-line icon next to the URL bar, then click Cookies and site data → Manage on site data.
2

Block all listed domains

For every domain listed under Data on the site you’re viewing, click the three-dot menu and select Don’t allow to save data.
3

Refresh the page

Click the bright blue Done button, then refresh the page.
4

Attempt to sign in

Click the Sign in button in the top-right corner.
5

Handle the cookie error

Sign in with your personal Gmail. You will likely see an error that Cookies are disabled. Go back to the cookie settings for the page and allow account.google.com specifically (click its three-dot menu and allow). Click the back arrow and try signing in again.
6

Re-enable cookies for Google services

After successfully signing in, various Google services (Classroom, Docs, Gmail) may not work. Fix each one by allowing cookies for that specific domain only (e.g., classroom.google.com, mail.google.com, docs.google.com).
Alternative starting point: Go to gmail.com instead — it will show an error. Allow cookies for mail.google.com only, then switch accounts to continue from Step 5 above.Credits: crimsondeityofflame, Titanium Network
Requires ChromeOS v127 or lower and an Android phone. Escape the OOBE (Out Of Box Experience) enrollment flow to sign in with a personal account persistently. Patched after v127.
This does not clear FWMP, so device unenrollment is likely impossible. You will not be able to enter developer mode after using this method. Powerwash beforehand.
1

Connect to Wi-Fi

On the OOBE welcome screen, connect to Wi-Fi via Quick Settings.
2

Start OOBE and transfer Wi-Fi from phone

Press Ctrl+Alt+Q and click Get Started. Transfer Wi-Fi from your Android phone when prompted. Connect your phone from the popup, scan the QR code, and use your fingerprint.
3

Transfer Wi-Fi again, then close the app

Transfer Wi-Fi from the phone again, then close the app on your phone.
4

Sign in and complete setup

Log in to your Google account and go through Chromebook setup.
5

Sign out via keyboard shortcut

Press Ctrl+Shift+Q+Q to sign out.
6

Complete the second OOBE pass

Click Get Started → Next. You will be presented with three sign-in options — choose a personal account and sign in for persistent unenrollment.
Credits: copernicium server (.gg/ZC3yNU4rww), byte (original bug), kilo (persistence), hannah (OOBESCAPE name)
ChromeOS v133–v138 (patch incoming for v138). An updated OOBE escape that provides unenrollment until next powerwash. Does not require an Android phone.
An incoming patch is planned for ChromeOS v138. Do not update past v137 if you want to keep this working. Source: chromium-review.googlesource.com
1

Powerwash your Chromebook

Perform a powerwash to reach the Welcome screen.
2

Wait for the Quick Setup button

On the “Welcome to your Chromebook” screen, do not press Get Started immediately. Wait until you see the Quick set up with Android button, then press it.
3

Open and cancel Powerwash

Press Ctrl+Alt+Shift+R and click Cancel.
4

Enter Google account setup

Click Enter your Google account email and password. It will ask you to connect to a network.
5

Connect to Wi-Fi

Open Quick Settings from the bottom right and connect to a network.
6

Sign in

Sign in with your personal or school Google account.
For persistence (survive sign-out/reboot):
  1. After signing in, sign out — you will return to the Welcome screen.
  2. Click Get Started → Next — you will see three sign-in options.
  3. Sign in with the same email; the Chromebook will hang on Please Wait.
  4. Restart or press Alt+VolUp+X — you will be placed at the lock screen.
  5. From now on, you can sign out and reboot and it will persist until the next powerwash.
Credits: crosbreaker/sh1ttyOOBE, Titanium Network
Bypass the SecondaryGoogleAccountSigninAllowed policy and add any personal Google account (one account) to Chrome for use with Docs, Gmail, Drive, etc. Does not work if the AllowedDomainsForApps policy is enforced.Requirements:
  • Access to https://myaccount.google.com/device-activity for your managed account, OR ability to change your managed account password through your school’s website
  • A personal Google account
  • A second device (phone, computer, or another Chromebook)
Preparation:
  1. On your managed Chromebook, go to https://workspace.google.com/gmail/.
  2. On your other device, go to https://myaccount.google.com/device-activity, find your managed Chromebook in the listed devices, and click Log out. Wait for the sign-in error notification on your Chromebook. Alternatively, change your managed account password through your school’s website.
1

Click Sign in after the error

When you receive the sign-in error notification, click Sign in in the top left of the Gmail for Workspace page.
2

Remove the managed account

Click Remove an account, then click the red minus symbol next to your account.
3

Add your personal account

Enter your personal Google account credentials. The account is now added.
4

Access Google services as your personal account

Your personal account is the second account (index 1). To access Google services, append /u/1 to the URL — for example, drive.google.com/u/1, mail.google.com/u/1.
Credits: player2username, Titanium Network

Build docs developers (and LLMs) love

Get started for freeTalk to us