Google has announced new Chrome protections against scams and social engineering, including new site warnings, server-side Gemini analysis, and detection of ClickFix commands.
The Gemini and ClickFix protections are part of Enhanced Protection, the Safe Browsing mode Google introduced in 2020. Last year, the company said more than 1 billion Chrome users had turned it on.
Google claims Enhanced Protection makes users “ten times safer” than Standard Protection against phishing, social engineering, notification abuse, and other scams. The metric is based on how many safety warnings, on average, each group of users receives.
Chrome’s Safe Browsing site warnings now come in two levels, mirroring a model previously applied to file downloads. When Safe Browsing is highly confident a page is malicious, users still get the full-page red ‘dangerous site’ warning.
The new ‘suspicious site’ level covers lower-confidence verdicts. It flags pages that use deceptive tactics typical of known malicious sites. Because these warnings have their own design, Google says it can safely display more of them.
Gemini-powered scam detection has also moved to Google’s servers. The on-device version launched last year focused on tech support scams and was limited to Enhanced Protection users on supported devices.
The more capable server-side model is now available to every Enhanced Protection user. It also targets additional threats, such as fake antivirus and fake browser update pages.
The model’s review of a page looks at signals such as the brand on display, the page’s purpose, and a scam likelihood score. “Safe Browsing then considers Gemini’s analysis, in combination with domain reputation and other security signals, to generate a final verdict,” Google explains.
The company says page text is only analyzed when a site shows strong signs of being a scam. Any page content that leaves the device is handled ephemerally and is not logged, stored, or used to train AI models.
In ClickFix attacks, victims are lured into pasting and running commands themselves. Those commands almost always invoke living-off-the-land binaries such as PowerShell. Since the malware download takes place in the terminal rather than the browser, Chrome and Safe Browsing download protections never come into play.
Chrome can now spot when Enhanced Protection users are manipulated into copying a suspicious command. “If a potential ClickFix script is copied, the clipboard payload is scrubbed of PII and sent to Safe Browsing for further analysis, and if a dangerous verdict is returned, Chrome shows a warning,” Google says.
“This system is designed to be high precision, in order to protect users in real time while minimizing disruption to legitimate developer activity,” the company adds.
Chrome now asks before connecting over HTTP
Chrome also now prompts users for approval before it connects to a site over unencrypted HTTP. Enhanced Protection users received the feature earlier this year. As promised last year, Google has now turned it on by default for everyone.
According to Google, the ‘Not Secure’ label alone falls short. Research shows that passive indicators like it can go unnoticed, and short-lived HTTP traffic such as redirects never receives the label at all. The bigger problem, the company says, is that the label only appears once the user’s data and connection are already exposed.
The prompt is shown on the first visit to an HTTP site. “Once the HTTP use is approved, Chrome will not warn again until the user has not visited the site for at least two weeks,” Google notes.
By default, sites that can’t obtain a publicly trusted HTTPS certificate don’t trigger warnings. Examples include single-label hostnames and local IP addresses. Google says these hosts are typically at lower risk, as an attacker would have to be on the same local network to tamper with the traffic.
Early rollout figures show that nearly 95% of desktop Chrome users encounter no HTTP warnings during a given week, while under 1% see three or more. Mobile users see the warnings even less often.
Google notes that Chrome is the first browser to adopt this approach and says it hopes others will follow its lead.
Related: Chrome 153 Patches Seventh Zero-Day of 2026
Related: Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise
Related: Google Partially Reverses Chrome Bug Bounty Cuts
