Google Chrome now checks commands that Enhanced Protection users copy and warns them when Safe Browsing judges one to be a ClickFix attack, the trick that gets people to run an attacker's command on their own computer. The check is one of several Safe Browsing features Google has added to Enhanced Protection in 2026.
A ClickFix page shows a fake error and tells the visitor to copy a line and run it to repair the problem. The command that gets pasted is often not the one shown on the page, and it almost always invokes a pre-installed operating system tool such as PowerShell or cmd.exe to download and set up malware. Because the download then happens in the terminal, Google says, it sidesteps the download protections Chrome and Safe Browsing apply inside the browser.
When Google Chrome sees an Enhanced Protection user copy a script that looks like ClickFix, Google says, it strips personal information from the clipboard contents and sends them to Safe Browsing. A dangerous verdict triggers a warning. Google says the system is designed for high precision, to keep disruption to legitimate developer work to a minimum.
Site warnings in Google Chrome now come in two tiers for the same users:
| Tier | Verdict | What the user sees |
|---|---|---|
| Suspicious | Lower confidence, possible harm | New warning with its own format, icon, color and text |
| Dangerous | High confidence, high risk of harm | The familiar full-page red interstitial |
Suspicious warnings fire when a page shows deceptive patterns common to known malicious sites. Google says tailoring the warning this way lets it safely expand coverage and show more protective warnings. Chrome already splits download warnings into suspicious and dangerous files the same way.
Chrome's Gemini-based scam detection has also moved to Google's servers. It began in May 2025 with Chrome 137, when an on-device Gemini Nano model checked pages for tech support scams for Enhanced Protection users on supported devices, as Google described then. Google now runs a more powerful server-side Gemini model for everyone with Enhanced Protection on, covering a broader range of threats like fake antivirus and browser update scams. The model looks at indicators including the brand a page represents, its intent and a scam-likeliness score, and Safe Browsing weighs that analysis with domain reputation and other signals before issuing a verdict.
Google says Enhanced Protection, which more than 1 billion Chrome users had turned on as of 2025, makes users ten times safer than Standard Protection against phishing, social engineering, notification abuse and other scams. Google calculated that figure by comparing the average number of safety warnings shown to users in each mode.
According to Google, the server-side model sees page text only when a site already shows high-confidence scam indicators. Google says that content is processed ephemerally, never logged or retained, and never used to train models.
