Google Chrome'da firibgarlik va ijtimoiy muhandislikka qarshi yangi himoyalar, jumladan yangi sayt ogohlantirishlari, server tomonidagi Gemini tahlili va ClickFix buyruqlarini aniqlash e'lon qilindi.
Gemini va ClickFix himoyalari Enhanced Protection (Kuchaytirilgan himoya) tarkibiga kiradi — bu Google 2020-yilda joriy etgan Safe Browsing (Xavfsiz ko'rish) rejimi. O'tgan yili kompaniya 1 milliarddan ortiq Chrome foydalanuvchisi uni yoqganini aytgan edi.
Google ta'kidlashicha, Enhanced Protection foydalanuvchilarni Standard Protection (Standart himoya) bilan solishtirganda "o'n barobar xavfsizroq" qiladi — bu phishing, ijtimoiy muhandislik, bildirishnomalarni suiiste'mol qilish va boshqa firibgarliklarga qarshi. Ko'rsatkich har bir foydalanuvchilar guruhiga o'rtacha qancha xavfsizlik ogohlantirishlari kelishiga asoslangan.
Chrome'ning Safe Browsing sayt ogohlantirishlari endi ikki darajaga ega — bu avval fayl yuklab olishlarga qo'llanilgan modelga o'xshaydi. Safe Browsing sahifa zararli ekanligiga yuqori ishonch bilan qaraganda, foydalanuvchilar hali ham to'liq sahifali qizil "xavfli sayt" ogohlantirishini oladi.
Yangi "shubhali sayt" darajasi pastroq ishonchli hukmlarni qamrab oladi. U ma'lum zararli saytlarga xos aldovchi usullarni ishlatadigan sahifalarni belgilaydi. Bu ogohlantirishlar o'z dizayniga ega bo'lgani uchun, Google ularni xavfsizroq ko'proq ko'rsatishi mumkinligini aytadi.
Gemini bilan ishlaydigan firibgarlikni aniqlash ham Google serverlariga ko'chirildi. O'tgan yili joriy etilgan qurilma ichidagi versiya texnik yordam firibgarliklariga e'tibor qaratgan va faqat qo'llab-quvvatlanadigan qurilmalardagi Enhanced Protection foydalanuvchilari uchun cheklangan edi. Reklama. O'qishni davom ettirish uchun pastga aylantiring.
Endi har bir Enhanced Protection foydalanuvchisi uchun mavjud bo'lgan yanada kuchli server tomonidagi model qo'shimcha tahdidlarga, masalan, soxta antivirus va soxta brauzer yangilanish sahifalariga ham e'tibor qaratadi.
Modelning sahifani ko'rib chiqishi brend, sahifaning maqsadi va firibgarlik ehtimoli balli kabi signallarga qaraydi. "Safe Browsing keyin Gemini tahlilini, domen obro'si va boshqa xavfsizlik signallari bilan birga, yakuniy hukmni shakllantirish uchun ko'rib chiqadi", deb tushuntiradi Google.
Kompaniya sahifa matni faqat sayt firibgarlikning kuchli belgilarini ko'rsatganda tahlil qilinishini aytadi. Qurilmadan chiqadigan har qanday sahifa mazmuni vaqtinchalik ishlanadi va jurnalga yozilmaydi, saqlanmaydi yoki AI modellarini o'qitish uchun ishlatilmaydi.
ClickFix hujumlarida jabrlanuvchilar o'zlari buyruqlarni nusxalab, ishga tushirishga jalb qilinadi. Bu buyruqlar deyarli har doim PowerShell kabi "yashovchi" (living-off-the-land) binar fayllarini chaqiradi. Zararli dastur yuklab olish terminalda, brauzerda emas, sodir bo'lgani uchun Chrome va Safe Browsing yuklab olish himoyalari hech qachon ishga tushmaydi.
Chrome endi Enhanced Protection foydalanuvchilari shubhali buyruqni nusxalashga jalb qilinganda aniqlay oladi. "Agar potentsial ClickFix skripti nusxalansa, clipboard yuklamasi PII'dan tozalanadi va keyingi tahlil uchun Safe Browsing'ga yuboriladi, va agar xavfli hukm qaytarilsa, Chrome ogohlantirish ko'rsatadi", deb aytadi Google.
"Bu tizim yuqori aniqlikni ta'minlash uchun mo'ljallangan — foydalanuvchilarni real vaqtda himoya qilish va shu bilan birga qonuniy dasturchi faoliyatiga aralashuvni minimallashtirish", deb qo'shimcha qiladi kompaniya.
Chrome endi HTTP orqali ulanishdan oldin foydalanuvchilardan ruxsat so'raydi
Chrome endi shifrlanmagan HTTP orqali saytga ulanishdan oldin foydalanuvchilardan tasdiq so'raydi. Enhanced Protection foydalanuvchilari bu xususiyatni joriy yilning boshida olgan edi. O'tgan yili va'da qilinganidek, Google endi uni hamma uchun sukut bo'yicha yoqdi.
Google'ga ko'ra, faqat "Xavfsiz emas" yorlig'i yetarli emas. Tadqiqotlar shuni ko'rsatadiki, bunday passiv ko'rsatkichlar e'tibordan chetda qolishi mumkin, va qisqa muddatli HTTP trafik, masalan, yo'naltirishlar, hech qachon yorliqni olmaydi. Kattaroq muammo, kompaniya aytishicha, yorliq faqat foydalanuvchining ma'lumotlari va ulanishi allaqachon ochiq bo'lgandan keyin paydo bo'lishidir.
So'rov HTTP saytiga birinchi tashrifda ko'rsatiladi. "HTTP foydalanish tasdiqlangandan so'ng, Chrome foydalanuvchi saytga kamida ikki hafta davomida tashrif buyurmaguncha yana ogohlantirmaydi", deb ta'kidlaydi Google.
Sukut bo'yicha, ommaviy ishonchli HTTPS sertifikatini ololmaydigan saytlar ogohlantirishni keltirib chiqarmaydi. Misollar: bitta yorliqli xost nomlari va mahalliy IP manzillar. Google aytishicha, bu xostlar odatda pastroq xavfga ega, chunki hujumchi trafikni buzish uchun o'sha mahalliy tarmoqda bo'lishi kerak.
Erta joriy etish raqamlari shuni ko'rsatadiki, har hafta ish stoli Chrome foydalanuvchilarining deyarli 95 foizi HTTP ogohlantirishlarini ko'rmaydi, 1 foizdan kamroq uch yoki undan ortiq ogohlantirishni ko'radi. Mobil foydalanuvchilar ogohlantirishlarni yanada kamroq ko'radi.
Google Chrome bu yondashuvni qabul qilgan birinchi brauzer ekanligini ta'kidlaydi va boshqalar ham uning yo'lidan borishiga umid qiladi.
Bog'liq: Chrome 153 2026-yilning yettinchi nol kunlik zaifligini tuzatdi
Bog'liq: Chrome, Firefox yangilanishlari 114 ta kamchilikni tuzatdi, Mozilla Firefox Enterprise'ni e'lon qildi
Bog'liq: Google Chrome xatolik mukofotini qisman qayta ko'rib chiqdi
Yozgan: Eduard Kovacs
Eduard Kovacs (@EduardKovacs) SecurityWeek'da katta boshqaruvchi muharrir. U avval o'rta maktab IT o'qituvchisi bo'lib ishlagan, keyin 2011-yilda jurnalistika sohasida faoliyat boshlagan. Eduard sanoat informatikasi bo'yicha bakalavr darajasiga va elektr muhandisligida kompyuter texnikasi bo'yicha magistr darajasiga ega.
Kundalik axborot byulleteni
So'nggi kiberxavfsizlik tahdidlari, tendentsiyalar va mutaxassis fikrlari haqida xabardor bo'lish uchun SecurityWeek elektron pochta axborotiga obuna bo'ling.
Eduard Kovacsdan ko'proq
Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI Accenture, Dragos, SANS Launch $10M Initiative to Defend Small US Utilities Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring 970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure One Compromised Login Exposed Millions of California Students' Records MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks
So'nggi yangiliklar
PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors 'Context Bombs' Cut AI Attack Success by Misleading Agents With Fake Targets High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 Asymptote Labs Lands $5.5 Million Seed for AI Agent Runtime Security Memory Bugs Account for Most of Chrome's 353 New Security Fixes OpenAI Agents Silenced Security Team Alerts, Removed Misalignment Monitor Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys China Defends DeepSeek After US Ban of Its AI From Government Systems
Trend
PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks US Agencies Detail Incident Response Practices for Rogue AI Agents MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack One Compromised Login Exposed Millions of California Students' Records
Kundalik axborot byulleteni
So'nggi tahdidlar, tendentsiyalar va texnologiyalar, shuningdek, soha mutaxassislarining chuqur fikrlari haqida xabardor bo'lish uchun SecurityWeek elektron pochta axborotiga obuna bo'ling.
Vebinar: Google Workspace'dagi AI kirish xavfi allaqachon mavjud
19-oktabr, 2026
Google Workspace'ga ulangan AI vositalari millionlab nozik elektron pochta va fayllarga kirishi mumkin. Tashkilotingiz xavfini aniqlash va AI kirishini boshqarish uchun ramka o'rganish uchun ushbu sessiyaga qo'shiling.
Ro'yxatdan o'tish
Virtual tadbir: CISO Forum 2026 Sammiti
10 va 11-noyabr, 2026
CISO'lar, yuqori darajadagi kiberxavfsizlik rahbarlari, amaliyotchilar, soha mutaxassislari va boshqa xavfsizlik rahbarlarini amaliy tajriba almashish va korporativ kiberxavfsizlik strategiyasini shakllantiradigan masalalarni ko'rib chiqish uchun birlashtiramiz.
Ro'yxatdan o'tish
Harakatdagi odamlar
Jon Steinbach Pentagon CIO'sining strategik texnik maslahatchisi etib tayinlandi.
Vasu Jakkal Armadin'ga CSBO sifatida qo'shildi.
Ivanti Robert Ruelasni CRO va Sterling Parkerni CCO etib tayinladi.
Ko'proq harakatdagi odamlar Mutaxassis fikrlari
AI dasturiy ta'minot xavfsizligining kaliti tezlik emas, balki yetuklik
Sizning dasturchilaringiz AI qabul qilish shkalasida qayerda joylashganligi xavfsizlik xavfini qanday hal qilayotganingizga haqiqiy ta'sir ko'rsatadi. (Matias Madou)
Google has announced new Chrome protections against scams and social engineering, including new site warnings, server-side Gemini analysis, and detection of ClickFix commands.
The Gemini and ClickFix protections are part of Enhanced Protection, the Safe Browsing mode Google introduced in 2020. Last year, the company said more than 1 billion Chrome users had turned it on.
Google claims Enhanced Protection makes users “ten times safer” than Standard Protection against phishing, social engineering, notification abuse, and other scams. The metric is based on how many safety warnings, on average, each group of users receives.
Chrome’s Safe Browsing site warnings now come in two levels, mirroring a model previously applied to file downloads. When Safe Browsing is highly confident a page is malicious, users still get the full-page red ‘dangerous site’ warning.
The new ‘suspicious site’ level covers lower-confidence verdicts. It flags pages that use deceptive tactics typical of known malicious sites. Because these warnings have their own design, Google says it can safely display more of them.
Gemini-powered scam detection has also moved to Google’s servers. The on-device version launched last year focused on tech support scams and was limited to Enhanced Protection users on supported devices.Advertisement. Scroll to continue reading.
The more capable server-side model is now available to every Enhanced Protection user. It also targets additional threats, such as fake antivirus and fake browser update pages.
The model’s review of a page looks at signals such as the brand on display, the page’s purpose, and a scam likelihood score. “Safe Browsing then considers Gemini’s analysis, in combination with domain reputation and other security signals, to generate a final verdict,” Google explains.
The company says page text is only analyzed when a site shows strong signs of being a scam. Any page content that leaves the device is handled ephemerally and is not logged, stored, or used to train AI models.
In ClickFix attacks, victims are lured into pasting and running commands themselves. Those commands almost always invoke living-off-the-land binaries such as PowerShell. Since the malware download takes place in the terminal rather than the browser, Chrome and Safe Browsing download protections never come into play.
Chrome can now spot when Enhanced Protection users are manipulated into copying a suspicious command. “If a potential ClickFix script is copied, the clipboard payload is scrubbed of PII and sent to Safe Browsing for further analysis, and if a dangerous verdict is returned, Chrome shows a warning,” Google says.
“This system is designed to be high precision, in order to protect users in real time while minimizing disruption to legitimate developer activity,” the company adds.
Chrome now asks before connecting over HTTP
Chrome also now prompts users for approval before it connects to a site over unencrypted HTTP. Enhanced Protection users received the feature earlier this year. As promised last year, Google has now turned it on by default for everyone.
According to Google, the ‘Not Secure’ label alone falls short. Research shows that passive indicators like it can go unnoticed, and short-lived HTTP traffic such as redirects never receives the label at all. The bigger problem, the company says, is that the label only appears once the user’s data and connection are already exposed.
The prompt is shown on the first visit to an HTTP site. “Once the HTTP use is approved, Chrome will not warn again until the user has not visited the site for at least two weeks,” Google notes.
By default, sites that can’t obtain a publicly trusted HTTPS certificate don’t trigger warnings. Examples include single-label hostnames and local IP addresses. Google says these hosts are typically at lower risk, as an attacker would have to be on the same local network to tamper with the traffic.
Early rollout figures show that nearly 95% of desktop Chrome users encounter no HTTP warnings during a given week, while under 1% see three or more. Mobile users see the warnings even less often.
Google notes that Chrome is the first browser to adopt this approach and says it hopes others will follow its lead.
Related: Chrome 153 Patches Seventh Zero-Day of 2026
Related: Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise
Related: Google Partially Reverses Chrome Bug Bounty Cuts
Written By Eduard Kovacs
Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
More from Eduard Kovacs
Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI Accenture, Dragos, SANS Launch $10M Initiative to Defend Small US Utilities Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring 970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure One Compromised Login Exposed Millions of California Students’ Records MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks
Latest News
PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors ‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 Asymptote Labs Lands $5.5 Million Seed for AI Agent Runtime Security Memory Bugs Account for Most of Chrome’s 353 New Security Fixes OpenAI Agents Silenced Security Team Alerts, Removed Misalignment Monitor Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys China Defends DeepSeek After US Ban of Its AI From Government Systems
Trending
PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars
Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure
Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks
US Agencies Detail Incident Response Practices for Rogue AI Agents
MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks
Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack
One Compromised Login Exposed Millions of California Students’ Records
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Webinar: The AI Access Risk Already in Your Google Workspace
October 19, 2026
AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Jon Steinbach has been appointed strategic technical advisor to the Pentagon’s CIO.
Vasu Jakkal has joined Armadin as CSBO.
Ivanti has named Robert Ruelas as CRO and Sterling Parker as CCO.
More People On The MoveExpert Insights
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk. (Matias Madou)