Chrome Adds Softer ‘Suspicious Site’ Warnings, Cloud Gemini Scam Checks and ClickFix Detection
Chrome is getting a second, softer kind of scam warning. In an October 20 Google blog post, Chrome group product manager Jasika Bawa outlined three new defenses for people using Safe Browsing’s Enhanced Protection mode, which Google said in 2025 had more than 1 billion users.
Suspicious versus dangerous
Until now, a Chrome site warning meant the full-page red screen for pages known to be malicious. With Enhanced Protection on, Chrome now splits warnings into two tiers, borrowing the model it already uses for downloads. Dangerous sites, a “high confidence verdict, high risk of user harm,” still get the red interstitial. Suspicious sites, a “lower confidence verdict, possible risk of user harm,” get a new warning with a different format, icon, color, and text. Google says these flag pages that show “deceptive patterns commonly associated with known malicious sites,” and that the softer design lets it “safely expand our coverage to display a higher volume of protective warnings.”
Gemini moves to the cloud
Last year Chrome began using the on-device Gemini Nano model to spot tech support scams, but only on supported devices. Google has now switched to a more powerful server-side Gemini model so the check reaches every Enhanced Protection user and covers more scams, including fake antivirus and fake browser update pages. The model looks at the brand a page represents, its intent, and a scam likeliness score, and Safe Browsing combines that with domain reputation and other signals to decide. Google says Chrome only sends page text when a site already shows high-confidence scam signs, and that the text is “never logged, retained or used to train models.”
Catching ClickFix at the clipboard
The third feature targets ClickFix, a trick where a fake error or fake CAPTCHA tells you to paste a “fix” into PowerShell or the Windows Run box. Because the malware then downloads through built-in system tools, it skips Chrome’s download protections entirely. Chrome can now detect when an Enhanced Protection user copies a suspicious command, strip personal information from it, and send it to Safe Browsing. If the verdict comes back dangerous, Chrome shows a warning. Google says the check is tuned for high precision so it doesn’t get in the way of normal developer work.
What’s still unclear
As PPC Land points out, Google gave no Chrome version, rollout schedule, or platform breakdown, and didn’t explain how site owners would learn about or contest a suspicious verdict. Google also claims Enhanced Protection users are now ten times safer than Standard Protection users, but its footnote says that figure compares the average number of warnings shown, not scams actually stopped. Enhanced Protection is opt-in, and you can turn it on under Privacy and security in Chrome’s settings.