Chrome scam protection is expanding with Gemini-powered website analysis and warnings about suspicious commands used in ClickFix attacks. The features form part of Enhanced Protection, the browser’s optional Safe Browsing security setting.
Google is also introducing a warning for websites that display deceptive behavior but fall below the threshold for a full-page danger alert. Together, the changes aim to identify more scams before users follow harmful instructions.
Gemini Analyzes Potential Scam Pages on Google’s Servers
Chrome previously used an on-device Gemini model to identify technical support scams. Now, Google is moving that analysis to a more powerful server-side model for Enhanced Protection users.
The model examines signals such as the brand a page represents, its apparent purpose and the likelihood of a scam. Safe Browsing then combines those findings with domain reputation and other security indicators.
As a result, the assessment draws on both page content and broader information about the website.
Google says Chrome limits the information it shares by analyzing page text only when a site shows strong scam indicators. According to the company, it processes any page content sent off the device temporarily.
Google also says it does not log, retain or use that content to train its models.
Chrome Scam Protection Targets Copied ClickFix Commands
The update also addresses ClickFix, a social engineering technique that persuades people to execute malicious commands themselves.
These scams commonly instruct users to copy a command and run it through PowerShell or Command Prompt. The instructions may appear to offer a solution to a fabricated technical problem.
Enhanced Protection can now inspect suspicious commands when users copy them from a webpage. If Chrome suspects a ClickFix script, it removes personally identifiable information from the clipboard payload before sending it to Safe Browsing.
The service then analyzes the command. If it identifies a dangerous payload, Chrome displays a warning before the user proceeds.
This creates an opportunity to interrupt the scam between copying the command and following the attacker’s instructions. However, the described feature provides a warning; it does not establish that Chrome prevents every subsequent attempt to run the command.
Suspicious-Site Alerts Cover Less Certain Threats
Google is also adding a separate suspicious-site warning.
Chrome already uses a full-page red alert for threats that meet its existing confidence requirements. However, some pages display deceptive patterns without providing enough evidence for that stronger intervention.
The new warning addresses those cases. It alerts users when a page resembles known malicious sites, even if the assessment remains below the full-page warning threshold.
Consequently, Chrome can flag a broader range of potentially harmful pages while distinguishing suspicion from a more confident threat finding.
Enhanced Protection Includes the New Defenses
The Gemini analysis and ClickFix detection belong to Enhanced Protection rather than Standard Protection.
Google claims Enhanced Protection makes users ten times safer from phishing, social engineering, notification abuse and other scams compared with its standard setting. That figure represents the company’s assessment, rather than an independent finding presented in the announcement.
The changes focus on two moments when intervention may help: encountering a deceptive website and copying a potentially harmful command.
For users, the central warning remains straightforward: a webpage’s instructions to run commands deserve scrutiny, particularly when they claim that doing so will fix an unexpected problem.
0 responses to “Chrome Scam Protection Adds Gemini and ClickFix Warnings”