You click a link, a page screams that your laptop is “infected”, and a friendly box tells you to copy one short command to fix it. That trick has fooled a lot of people. Google now wants Chrome to step in before you paste anything.
Google announced on October 20 a new set of Chrome scam protection features, built mostly into the browser’s Enhanced Protection mode. They include a new “suspicious site” warning, Gemini AI checks that now run on Google’s servers, alerts for so-called ClickFix commands, and a prompt before Chrome opens any unencrypted HTTP site. The update was announced by Jasika Bawa, Group Product Manager for Chrome, and has been widely covered this week, including by Indian outlets.
Quick Facts
- Who: Google’s Chrome and Safe Browsing teams
- What: Two-level site warnings, server-side Gemini scam detection, ClickFix copy alerts and HTTP connection prompts
- When: Announced October 20, 2026
- Who gets it: Mostly Enhanced Protection users; the HTTP prompt is on by default for everyone
- Key number: Google says Enhanced Protection users are “ten times safer” than Standard Protection users, based on the warnings each group sees
Chrome’s New “Suspicious Site” Warning, Explained
Until now, Chrome mostly had one big tool: the full-page red screen that says a site is dangerous. That stays. It will still appear when Safe Browsing is highly confident a page is malicious.
The new layer sits below it. A “suspicious site” warning covers pages where Google is less sure, but which use the same deceptive tricks seen on known scam sites. According to 9to5Google, these show up as a shield icon in the address bar, with a small dialog offering “Mark as safe” or “Back to safety”.
Google copied this two-tier idea from the way Chrome already handles risky downloads. Because the lighter warning looks and feels different, Bawa said the company can “safely expand” its coverage and show more of these alerts without crying wolf with the red screen.
Gemini AI Scam Detection Moves to Google’s Servers
Last year Chrome started using an on-device version of Gemini to spot fake tech support pages. It only worked for Enhanced Protection users on supported devices, and it only looked for that one type of scam.
That check has now moved to a more capable model on Google’s servers, and it is available to every Enhanced Protection user. It also looks for two more common traps: fake antivirus pages and fake “update your browser” pages.
Gemini looks at things like which brand a page is pretending to be, what the page is trying to get you to do, and how likely it is to be a scam. Safe Browsing then mixes that with the domain’s reputation and other signals before deciding whether to warn you.
On privacy, Google says page text is only sent for analysis when a site already shows strong signs of being a scam. It says that content is handled temporarily and is not logged, stored or used to train AI models.
What Is a ClickFix Scam, and How Chrome Now Stops It
ClickFix scams are sneaky because you do the hacker’s work for them. A page shows a fake error or a fake “verify you are human” step, then asks you to copy a command and run it on your computer, often in PowerShell or the Windows command prompt. The command you copy can be different from the one shown on screen.
Since the malware download then happens in your computer’s terminal, not in the browser, Chrome’s usual download protections never get a chance to see it.
The fix: when an Enhanced Protection user copies something that looks like a ClickFix script, Chrome strips personal details from the copied text and sends it to Safe Browsing to check. If the verdict is “dangerous”, you get a warning. Google says the system is built to be “high precision” so it does not keep bothering developers who copy commands all day for legitimate work.
Chrome Will Now Ask Before Opening HTTP Sites
This one affects everyone, not just Enhanced Protection users. Chrome now asks for your approval before it connects to a site over plain, unencrypted HTTP. Enhanced Protection users got it earlier this year; Google has now switched it on by default for all users.
Google’s argument is simple: the small “Not Secure” label is easy to miss, and it only appears after your connection is already exposed. Once you approve an HTTP site, Chrome will not ask again unless you have not visited it for at least two weeks. Local addresses and similar internal hosts are left alone by default.
It should not be too annoying. Google’s early figures show nearly 95% of desktop Chrome users see no HTTP warning in a given week, and fewer than 1% see three or more.
Why This Matters for Chrome Users in India
Chrome is the default browser for a huge share of Indian phone and laptop users, and online fraud here often starts with a link: a fake courier page, a “KYC update” site, a bogus refund form or a fake tech support number. A lighter, more frequent warning could catch some of those borderline pages that never made it onto a blocklist.
The catch is that the best of these tools sit inside Enhanced Protection, which you may need to switch on yourself. Google said last year that more than a billion Chrome users had turned it on.
What We Don’t Know Yet
- Google has not shared how often the new “suspicious” warning might flag a genuine site by mistake.
- The “ten times safer” claim counts warnings shown, not scams actually prevented.
- Exact rollout timing for each device and region has not been spelled out.
What This Means for You
- Turn on Enhanced Protection: In Chrome, go to Settings > Privacy and security > Security and pick “Enhanced protection”.
- Never paste commands from a website into PowerShell, Command Prompt or Terminal unless you fully understand them. No real site needs you to do that to “verify” you.
- Take the shield icon seriously. If Chrome flags a page as suspicious, close it, especially if it asks for OTPs, card details or remote access.
- Keep Chrome updated so you get these protections as they roll out.
You can read Google’s own explanation of the protection levels on the Chrome Safe Browsing help page.
Our Take
The ClickFix alert is the smartest piece here, because it targets the moment scammers rely on most: you copying something you shouldn’t. The softer warning is a sensible idea too, as long as it stays accurate. If it starts flagging normal shops and blogs, people will learn to ignore it, and then it protects nobody.
FAQs
What is Chrome Enhanced Protection?
It is the strongest Safe Browsing mode in Chrome, introduced in 2020. It checks sites and downloads in real time and now includes Gemini-based scam detection and ClickFix alerts.
Does Google read every page I visit?
Google says page text is only sent for Gemini analysis when a site already shows strong scam signs, and that it is not stored or used for AI training.
What is a ClickFix attack?
It is a scam where a fake error page tricks you into copying and running a command on your computer, which then installs malware.
Why is Chrome asking before opening some websites?
Chrome now asks before connecting to sites that use unencrypted HTTP. Once you approve a site, it will not ask again unless you skip visiting it for two weeks.
Based on reporting by SecurityWeek, Help Net Security and 9to5Google.
Leave a Reply