Ember browser-helper droppers rode leftover holiday toolbars

Ember 2023 was a messy season for leftover holiday toolbars. Coupon add-ons that nobody meant to keep became a quiet path for browser-helper droppers. The first week after the sales rush, we saw profiles where a helper DLL sat next to an old toolbar folder and waited for the next browser start.

The dropper did not shout. It changed the search provider, then staged a second library with a generic name like helper64. Users noticed slower new tabs and odd redirect hosts, not a ransom note. That is why Ember 2023 still matters when we audit a profile that looks only slightly wrong.

Cleanup is still the same order we use on the Files hub. Export bookmarks, then remove the leftover toolbar folder before you reset the search engine. If you reset first, the helper writes the provider back on the next launch. Check the browser policy list as well. A local policy can pin a search host even after you delete the visible add-on.

If a machine from that season is still acting up, compare the helper path against the suspicious-files notes. Ember leftovers often share a timestamp with a December installer, even when the user swears nothing new was added. Keep the toolbar folder name in your ticket so we can match it to a known helper.