Google Chrome: Enhanced Protection now warns when a user is tricked into copying a suspicious ClickFix command, adds lower-confidence 'suspicious site' warnings, and moves Gemini scam detection to a server-side model (Google, 20 Oct)
Google said on 20 October 2026 that Chrome now detects when a user with Safe Browsing's Enhanced Protection mode is tricked into copying suspicious commands, the core step of ClickFix social engineering, in which a page tells the user to paste and run a command to 'fix' a fake problem. Google says that when a potential ClickFix script is copied, the clipboard payload is scrubbed of personal information and sent to Safe Browsing for analysis, and if the verdict is dangerous Chrome shows a warning; it says the system is designed to be high precision to limit disruption to legitimate developer activity. Google says ClickFix commands almost always invoke built-in tools such as PowerShell or cmd.exe, and that by moving the download out of the browser and into the terminal attackers sidestep Chrome's existing download protections. Also for Enhanced Protection users, Chrome is adding a two-tier taxonomy for Safe Browsing site warnings: new 'suspicious site' warnings for lower-confidence verdicts on pages showing deceptive patterns, alongside the existing full-page red warning for sites known to be dangerous. Google says it has moved Chrome's Gemini-based scam detection from an on-device model to a more powerful server-side Gemini model to cover all Enhanced Protection users and more threats, such as fake antivirus and browser update scams; it says Chrome only analyses page text when a site shows high-confidence scam indicators, and that page content sent off the device is processed ephemerally and never logged, retained or used to train models. Google says more than 1 billion Chrome users had Enhanced Protection on as of 2025. Primary: Google blog (Jasika Bawa, Chrome, 20 Oct); wire: The Hacker News (21 Oct).
- Product
- Google Chrome — Safe Browsing Enhanced Protection
- Versions
- n/a — protections for Chrome users with Enhanced Protection enabled (Google, 20 Oct 2026)
- Exploited in Australia?
- unknown
- Patch to
- No patch. The ClickFix copy warning, suspicious site warnings and server-side Gemini scam checks apply only when Safe Browsing's Enhanced Protection is on, so Google advises enabling Enhanced Protection in Chrome and on your Google Account. Keep telling staff that no website or browser legitimately asks them to paste a command into Run, PowerShell or Terminal; Google notes Chrome will never ask users to repair it that way.
Primary: Google — Our latest defenses against evolving web scams (Chrome Security, 20 Oct 2026) · The Hacker News — Google Chrome adds ClickFix warnings to stop users from running malicious commands (21 Oct 2026)