32-bit
wixmachine scopedl.google.com · publisher domain- File name
- googlechromestandaloneenterprise.msi
- SHA-256
- 531524c08fd04bdfb0f1f1db35b130169a3b1329b5dc05868aee1aeea12fa730
- Product code
- {B959D0EF-3707-33F5-BF48-DFBFD0668AE6}
by Google LLC · Freeware
The Fast & Secure Web Browser Built to be Yours
The download button on google.com/chrome gives you ChromeSetup.exe, a stub of about 1.5 MB that fetches the real browser while it installs. If the machine has no internet, or you are installing on many machines, that stub is useless. The offline installer is the complete package.
Google publishes standalone installers but does not link them from the main download page, which is the entire reason this is one of the most searched download questions there is.
The installers listed on this page are the full standalone builds declared in Google's own manifest. They install without any further download, and each one has a published SHA-256 you can check before running it.
Pick the machine-scope installer if you are deploying to a shared or managed computer: it installs for every user rather than only the account running it.
Installing offline does not freeze the version. Google Update runs afterwards and will bring the browser up to date as soon as the machine has a connection. To genuinely pin a version you have to disable the updater through policy, which is a separate decision.
These URLs are the ones Google LLC declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
More than one architecture below. Check which one your Windows is if you are not sure.
Run this against the file on disk. If the output does not match the hash below, the file is not what Google LLC published. Delete it.
Windows · PowerShell
Get-FileHash "googlechromestandaloneenterprise64.msi" -Algorithm SHA256macOS · Linux
shasum -a 256 "googlechromestandaloneenterprise64.msi"Expected output
50cf520d82c44077b0eb4a08237e240260ef75542733b4fa59ea69b9146f788d
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
If a program reported one of these as missing, this is the package it belongs to. Installing it puts the file where it goes, registered properly, which downloading the DLL on its own does not.
This installer is an MSI package, so it takes the standard Windows Installer switches. That is a property of MSI itself rather than something the publisher declared.
32-bit · machine scope · MSI convention
msiexec /i "googlechromestandaloneenterprise.msi" /qn /norestart64-bit · machine scope · MSI convention
msiexec /i "googlechromestandaloneenterprise64.msi" /qn /norestartARM64 · machine scope · MSI convention
msiexec /i "googlechromestandaloneenterprise_arm64.msi" /qn /norestartThe enterprise MSI is the deployable Chrome. The consumer download is a stub that fetches the browser during installation, so it neither works offline nor behaves predictably in a script.
Chrome takes no meaningful configuration on the command line. Policy comes from ADMX templates applied through Group Policy, or from the equivalent registry keys under HKLM\Software\Policies\Google\Chrome, and that is where you set the homepage, control extensions or manage the updater.
Google Update installs alongside Chrome and keeps it current on its own schedule. That is the right default for most people and a problem if you need a pinned version, in which case the update policy has to be set explicitly rather than by uninstalling the updater.
The enterprise bundle contains both, with names that differ by one character. Deploying the 32-bit package to 64-bit machines works and then quietly gives everyone the wrong build.
Run it from the folder holding the downloaded file, in a terminal opened as administrator when the package installs for all users. Silent means no window and no prompts, so check the exit code rather than waiting for something to appear: 0 is success and 3010 means it worked but wants a reboot.
Silent install commands for every program we index · silent uninstall
Every guide on this tells you to hunt for the product code with Get-WmiObject or in the registry. You do not need to: it is published in the installer manifest, and it is printed below.
Product code · 32-bit
{B959D0EF-3707-33F5-BF48-DFBFD0668AE6}
Uninstall, with the usual prompts
msiexec /x {B959D0EF-3707-33F5-BF48-DFBFD0668AE6}Silent, for deployment
msiexec /x {B959D0EF-3707-33F5-BF48-DFBFD0668AE6} /qn /norestartProduct code · 64-bit
{87A09251-FFBC-3D08-92EE-0EE8B728CFC6}
Uninstall, with the usual prompts
msiexec /x {87A09251-FFBC-3D08-92EE-0EE8B728CFC6}Silent, for deployment
msiexec /x {87A09251-FFBC-3D08-92EE-0EE8B728CFC6} /qn /norestartProduct code · ARM64
{010CA676-4E73-3BE3-9C8B-12E7FA1F31BF}
Uninstall, with the usual prompts
msiexec /x {010CA676-4E73-3BE3-9C8B-12E7FA1F31BF}Silent, for deployment
msiexec /x {010CA676-4E73-3BE3-9C8B-12E7FA1F31BF} /qn /norestartThe codes above belong to Google Chrome 151.0.7922.138, the version in our index. If you have an older release installed, its code is different and this command will report that the product is not installed. In that case run Get-Package -Name "Google*" in PowerShell to read the code of what you actually have.
This removes the program as the publisher packaged it. Settings and files created after installation, typically under AppData, are deliberately left behind by the uninstaller and have to be deleted by hand if you want them gone.
Reinstalling and hitting error 1638? That is this same product code, and the command above is the fix.
Product codes for every program we index, with the msiexec switches and how to read the code off your own machine.
The macOS build as Homebrew declares it, with the same treatment as the Windows side: the publisher's own URL and a hash to check it against.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 3 of 3 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 3 on the publisher's own domainThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 3 of 3 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 0 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | FreewareA declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Extensions Google Chrome registers itself to handle.
Yes, in the sense we can actually verify: the installer downloads from google.com, which is a domain we have tied to Google LLC.
Every one of the 3 installers on this page comes with the SHA-256 Google LLC declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 100/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id Google.Chrome --exactUpgrade later
winget upgrade --id Google.ChromeWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
Every Google Chrome version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Matched on the categories Google LLC and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
Not related to Google Chrome — just other entries, each with its own official URL and published hash.