Google is expanding Chrome’s Enhanced Protection with graded site warnings, server-side Gemini analysis and clipboard checks designed to expose phishing, fake updates and ClickFix malware attacks.
Google has expanded Chrome’s anti-scam defences with three new tools aimed at catching fraud earlier and making warnings easier to understand. In a blog post on 20 October, the company said it is strengthening Enhanced Protection in Safe Browsing so the browser can better identify phishing pages, social engineering attempts, fake antivirus prompts, bogus browser updates and “ClickFix” attacks. Google says the enhanced mode already offers roughly ten times the protection of Standard Protection against phishing, social engineering, notification abuse and similar scams, and that more than 1 billion Chrome users had enabled it by 2025.
The most visible change is a two-level warning system. Chrome will now distinguish between “suspicious sites” and “dangerous sites”, using a softer warning for lower-confidence threats and retaining the full-page red interstitial for pages judged to be highly malicious. According to Google, the aim is to give users more nuanced guidance before they proceed, rather than treating every risk in the same way. The company said the design, icons, colours and wording for the lower-severity alert are intended to encourage caution without blocking access outright.
Google is also broadening its use of Gemini models to spot scams beyond the device. The browser previously used on-device Gemini to identify technical-support fraud, but the new approach shifts more analysis to Google’s servers so it can examine a wider range of deceptive pages, including those impersonating security software or browser updates. The company says the model reviews elements such as the brand a page appears to represent, its apparent purpose and the likelihood that it is part of a scam, while Safe Browsing combines that output with signals such as domain reputation before deciding whether to warn the user. Google says page text is sent only after high-confidence scam indicators appear, is handled temporarily and is not stored or used to train the model.
The third addition targets ClickFix, a social-engineering tactic that tricks users into copying and running commands that appear to solve a problem but can instead launch PowerShell or cmd.exe to fetch malware. Chrome can now detect when a suspicious command has been copied, then send the clipboard content to Safe Browsing after removing personal information. If the content is judged risky, the browser issues a warning. Google says it is aiming for a high-precision system so that legitimate developer workflows are not disrupted, reflecting a broader effort to make browser security more adaptive as online fraud becomes more convincing.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
