Google Chrome updated its Enhanced Protection mode on October 20, 2026, by integrating a new server-side Gemini AI model for scam detection and adding specific protections against 'ClickFix' social engineering attacks, impacting over 1 billion users. This move aims to bolster user security against sophisticated online threats, particularly for those already opted into Chrome's advanced protection features.

This upgrade provides users with more advanced defenses against financial scams and malicious command execution, which often attempt to trick individuals into executing harmful code themselves.

What the records show: AI-powered Scam Detection

Google's new server-side Gemini model evaluates webpage content by analyzing key indicators, including the brand being represented, the page's apparent purpose or intent, and its scam likelihood score. This analysis is then combined with domain reputation and other security signals by Safe Browsing to determine whether a warning should be issued.

Google states that page text is submitted for server-side analysis only when the website already exhibits strong scam indicators. Furthermore, any content sent off the device for this analysis is processed ephemerally, meaning it is not logged, retained, or used to train AI models.

Combating 'ClickFix' Attacks

Chrome now detects when an Enhanced Protection user copies suspicious commands, offering specific defense against 'ClickFix' social engineering attacks. 'ClickFix' is a technique where deceptive web pages trick users into manually copying and executing malicious commands on their own computers, often under the guise of fixing a fake issue. These commands frequently involve system tools like PowerShell.

If a potential 'ClickFix' script is identified on the clipboard, the payload is scrubbed of any personally identifiable information (PII) before being sent to Safe Browsing for further analysis. If Safe Browsing returns a dangerous verdict, Chrome displays a warning to the user, preventing the execution of the malicious command.

Two Tiers of Site Warnings

Chrome has also introduced a new two-tier system for Safe Browsing site warnings within Enhanced Protection. This system categorizes potentially harmful websites into 'Suspicious Sites' and 'Dangerous Sites'.

'Suspicious Sites' exhibit deceptive patterns with lower confidence, and warnings for these feature a distinct user interface to communicate the lower-confidence assessment. This allows Chrome to expand warning coverage without treating every suspicious website as a confirmed threat. For 'Dangerous Sites,' which are identified with high confidence as malicious, Chrome continues to display its familiar full-page red interstitial warning.

Availability and Activation

These enhanced security features are exclusively available to users who have enabled Google Chrome's Enhanced Protection mode. By 2025, over 1 billion Chrome users had already adopted this mode. Users can enable Enhanced Protection within Chrome's settings by navigating to "Privacy and security" and then "Security".

What we could not confirm

It is not confirmed whether these new security features will also become available to Chrome users who have not enabled Enhanced Protection mode.