Оригинальный текст на языке EN взят с сайта-источника. Источник ↗

Google has announced new Chrome protections against scams and social engineering, including new site warnings, server-side Gemini analysis, and detection of ClickFix commands.

The Gemini and ClickFix protections are part of Enhanced Protection, the Safe Browsing mode Google introduced in 2020. Last year, the company said more than 1 billion Chrome users had turned it on.

Google claims Enhanced Protection makes users “ten times safer” than Standard Protection against phishing, social engineering, notification abuse, and other scams. The metric is based on how many safety warnings, on average, each group of users receives.

Chrome’s Safe Browsing site warnings now come in two levels, mirroring a model previously applied to file downloads. When Safe Browsing is highly confident a page is malicious, users still get the full-page red ‘dangerous site’ warning.

The new ‘suspicious site’ level covers lower-confidence verdicts. It flags pages that use deceptive tactics typical of known malicious sites. Because these warnings have their own design, Google says it can safely display more of them.

Gemini-powered scam detection has also moved to Google’s servers. The on-device version launched last year focused on tech support scams and was limited to Enhanced Protection users on supported devices.Advertisement. Scroll to continue reading.

The more capable server-side model is now available to every Enhanced Protection user. It also targets additional threats, such as fake antivirus and fake browser update pages.

The model’s review of a page looks at signals such as the brand on display, the page’s purpose, and a scam likelihood score. “Safe Browsing then considers Gemini’s analysis, in combination with domain reputation and other security signals, to generate a final verdict,” Google explains.

The company says page text is only analyzed when a site shows strong signs of being a scam. Any page content that leaves the device is handled ephemerally and is not logged, stored, or used to train AI models.

In ClickFix attacks, victims are lured into pasting and running commands themselves. Those commands almost always invoke living-off-the-land binaries such as PowerShell. Since the malware download takes place in the terminal rather than the browser, Chrome and Safe Browsing download protections never come into play.

Chrome can now spot when Enhanced Protection users are manipulated into copying a suspicious command. “If a potential ClickFix script is copied, the clipboard payload is scrubbed of PII and sent to Safe Browsing for further analysis, and if a dangerous verdict is returned, Chrome shows a warning,” Google says.

“This system is designed to be high precision, in order to protect users in real time while minimizing disruption to legitimate developer activity,” the company adds.

Chrome now asks before connecting over HTTP

Chrome also now prompts users for approval before it connects to a site over unencrypted HTTP. Enhanced Protection users received the feature earlier this year. As promised last year, Google has now turned it on by default for everyone.

According to Google, the ‘Not Secure’ label alone falls short. Research shows that passive indicators like it can go unnoticed, and short-lived HTTP traffic such as redirects never receives the label at all. The bigger problem, the company says, is that the label only appears once the user’s data and connection are already exposed.

The prompt is shown on the first visit to an HTTP site. “Once the HTTP use is approved, Chrome will not warn again until the user has not visited the site for at least two weeks,” Google notes.

By default, sites that can’t obtain a publicly trusted HTTPS certificate don’t trigger warnings. Examples include single-label hostnames and local IP addresses. Google says these hosts are typically at lower risk, as an attacker would have to be on the same local network to tamper with the traffic.

Early rollout figures show that nearly 95% of desktop Chrome users encounter no HTTP warnings during a given week, while under 1% see three or more. Mobile users see the warnings even less often.

Google notes that Chrome is the first browser to adopt this approach and says it hopes others will follow its lead.

Related: Chrome 153 Patches Seventh Zero-Day of 2026

Related: Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise

Related: Google Partially Reverses Chrome Bug Bounty Cuts

Written By Eduard Kovacs

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

More from Eduard Kovacs

Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI Accenture, Dragos, SANS Launch $10M Initiative to Defend Small US Utilities Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring 970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure One Compromised Login Exposed Millions of California Students’ Records MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks

Latest News

PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors ‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 Asymptote Labs Lands $5.5 Million Seed for AI Agent Runtime Security Memory Bugs Account for Most of Chrome’s 353 New Security Fixes OpenAI Agents Silenced Security Team Alerts, Removed Misalignment Monitor Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys China Defends DeepSeek After US Ban of Its AI From Government Systems

Trending

PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws

US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars

Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure

Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks

US Agencies Detail Incident Response Practices for Rogue AI Agents

MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks

Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack

One Compromised Login Exposed Millions of California Students’ Records

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Webinar: The AI Access Risk Already in Your Google Workspace

October 19, 2026

AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.

Register

Virtual Event: CISO Forum 2026 Summit

November 10 & 11, 2026

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Register

People on the Move

Jon Steinbach has been appointed strategic technical advisor to the Pentagon’s CIO.

Vasu Jakkal has joined Armadin as CSBO.

Ivanti has named Robert Ruelas as CRO and Sterling Parker as CCO.

More People On The MoveExpert Insights

The Key to AI Software Security Isn’t Speed, It’s Maturity

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk. (Matias Madou)