ERR_CONNECTION_RESET in Chrome: Why It Happens and How to Fix It

You click a link, Chrome spins for two seconds, and then dumps ERR_CONNECTION_RESET on the page. No partial load, no favicon, just a dead tab. This one tends to show up in three situations: you're on a corporate VPN, you just installed a new antivirus or endpoint protection agent, or you switched DNS providers and something in the middle doesn't like the new route. If it happens on one site, it's the site. If it happens on everything, it's your network stack — and that's what we're fixing here.

What ERR_CONNECTION_RESET actually means

TCP is a handshake protocol. Your machine sends a SYN packet, the server replies with SYN-ACK, you send ACK, and you're connected. ERR_CONNECTION_RESET means one side sent a RST packet — a hard kill — after the connection was either established or mid-negotiation. The RST doesn't tell you who sent it. It could be the remote server, your router, your firewall, your antivirus's HTTPS inspection driver, or a transparent proxy sitting on your ISP.

The culprit here is almost always something in the middle that's inspecting TLS traffic. Chrome uses QUIC (HTTP/3) over UDP on a lot of sites now, and a stateful firewall that only understands TCP will happily reset QUIC flows. Antivirus products like Kaspersky, Bitdefender, and older Symantec Endpoint builds do SSL interception — they break the chain and Chrome sees a reset instead of a cert error.

Common triggers I've seen on the job:

• Zscaler or Palo Alto doing TLS inspection and the cert store is stale
• Avast or AVG Web Shield after a silent update
• Chrome's Secure DNS turned on with a DoH resolver your firewall blocks
• An old proxy setting from a tool like Fiddler or Charles Proxy that never got cleaned up

The fix, in order

Work through these top to bottom. Don't skip — each one rules out a layer.

1. Kill QUIC for a test. Open chrome://flags/#enable-quic, set it to Disabled, and restart Chrome. If pages load now, your firewall doesn't handle UDP 443. Leave it disabled or fix the firewall rule.
2. Check proxy settings. In Windows: Settings → Network & Internet → Proxy. Make sure "Use a proxy server" is off unless you actually use one. On macOS: System Settings → Network → your adapter → Details → Proxies. Stale localhost:8888 entries from debugging sessions cause this constantly.
3. Disable antivirus web scanning temporarily. Not uninstall — just toggle the web shield off for five minutes. If the error vanishes, you've found it. Re-enable and add an exception, or update the AV cert in the Windows trust store.
4. Flush DNS and reset Winsock. From an admin Command Prompt:

   ipconfig /flushdns
   ipconfig /release
   ipconfig /renew
   netsh winsock reset
   netsh int ip reset

   Reboot. Winsock corruption is less common than Reddit says, but it's cheap to rule out.
5. Turn off Chrome's Secure DNS. chrome://settings/security → "Use secure DNS" → off. Then test. DoH queries to Cloudflare or Google get blocked on a lot of corporate networks and Chrome resets the whole connection as a result.
6. Try a clean Chrome profile. Launch with chrome.exe --user-data-dir=C:\temp\chrometest. If that works, your main profile has a corrupt extension or HSTS entry. Extensions like HTTPS Everywhere (dead project) and some ad blockers still cause this.
7. Check your hosts file and DNS. On Windows: C:\Windows\System32\drivers\etc\hosts. Any stale entries pointing a domain at 127.0.0.1 will get reset by the loopback. Same with /etc/hosts on Linux and macOS.

If it still fails

At this point you're past userland. Grab Wireshark and filter on tcp.flags.reset == 1. Watch which IP sends the RST. If it's your gateway, it's a policy. If it's the remote server, it's on them — check their status page and try curl -v https://the-site.com from a different network.

Other things worth checking:

• Try Firefox or Edge. If they work and Chrome doesn't, it's Chrome-specific — profile, flags, or QUIC.
• Test on a phone hotspot. If it works there, your office network is the problem, not the browser.
• Run netsh interface ipv6 show interface and consider disabling IPv6 temporarily. Broken IPv6 routes cause resets that look random.
• Check if you're on a metered or captive portal. Chrome sometimes caches a bad portal redirect.

If you're on a managed corporate machine and none of this works, it's the TLS inspection policy. Send your helpdesk the Wireshark capture. Don't waste time reinstalling Chrome — it hasn't fixed this error in fifteen years and it won't start now.