Google announced three Chrome protections on October 20, 2026, for people who enable Enhanced Protection: a lower-confidence warning for suspicious sites, expanded Gemini scam analysis and detection of suspicious commands copied in ClickFix attacks.
How Chrome distinguishes suspicious sites from dangerous ones
Google describes a suspicious-site warning as a lower-confidence assessment that a page may pose a risk to users. It can flag deceptive patterns associated with known malicious sites, but the warning does not mean Chrome has determined that the site is malicious. Google describes a dangerous-site verdict as high confidence and high risk of harm; its warning remains a full-page red screen.
Google says the new warning categories are for people using Enhanced Protection. The company describes the suspicious warning as visually distinct from the dangerous-site screen.
How Gemini analyzes scam pages
Google says the expanded scam analysis uses a server-side Gemini model to assess a page’s represented brand, intent and likelihood of being a scam. Safe Browsing combines that analysis with domain reputation and other security signals. Google says this broadens coverage for Enhanced Protection users to include fake antivirus and fake browser-update scams.
Google says page text is analyzed when high-confidence scam indicators appear. If content is sent off the device, Google says it is processed ephemerally and is not logged, retained or used to train models.
How Chrome handles copied ClickFix commands
ClickFix attacks use social engineering to persuade someone to copy and run a command to fix a fake problem. The command that gets pasted can differ from the one shown on the page; Google names PowerShell and cmd.exe as examples of built-in tools attackers may misuse.
For Enhanced Protection users, Google says Chrome removes personally identifiable information from a copied suspicious command before sending the clipboard payload to Safe Browsing. Chrome shows a warning if Safe Browsing returns a dangerous verdict.
