# Chrome Boosts Security with Gemini AI for Scam Detection and 'ClickFix' Defense

> Google Chrome updated its Enhanced Protection mode on October 20, 2026, integrating a new server-side Gemini AI model for scam detection and introducing specific protections against 'ClickFix' social engineering attacks for over 1 billion users.

By PrimaryBrief newsroom · Published 2026-10-25T02:24:45.775870Z
Canonical: https://primarybrief.com/article/chrome-boosts-security-with-gemini-ai-for-scam-detection-and-clickfix-defense-d5f72822

Google Chrome updated its Enhanced Protection mode on October 20, 2026, by integrating a new server-side Gemini AI model for scam detection and adding specific protections against 'ClickFix' social engineering attacks, impacting over 1 billion users [1][3][4][6][7][9]. This move aims to bolster user security against sophisticated online threats, particularly for those already opted into Chrome's advanced protection features [3][4][6][7].

This upgrade provides users with more advanced defenses against financial scams and malicious command execution, which often attempt to trick individuals into executing harmful code themselves [4][6][9][12].

## What the records show: AI-powered Scam Detection

Google's new server-side Gemini model evaluates webpage content by analyzing key indicators, including the brand being represented, the page's apparent purpose or intent, and its scam likelihood score [1][3][4][6][9][10]. This analysis is then combined with domain reputation and other security signals by Safe Browsing to determine whether a warning should be issued [1][3][4][6].

Google states that page text is submitted for server-side analysis only when the website already exhibits strong scam indicators [1][3][4][6][9][10]. Furthermore, any content sent off the device for this analysis is processed ephemerally, meaning it is not logged, retained, or used to train AI models [1][4][6][9][10].

## Combating 'ClickFix' Attacks

Chrome now detects when an Enhanced Protection user copies suspicious commands, offering specific defense against 'ClickFix' social engineering attacks [1][4][5][6][9]. 'ClickFix' is a technique where deceptive web pages trick users into manually copying and executing malicious commands on their own computers, often under the guise of fixing a fake issue [4][6][12][13][14][15]. These commands frequently involve system tools like PowerShell [9].

If a potential 'ClickFix' script is identified on the clipboard, the payload is scrubbed of any personally identifiable information (PII) before being sent to Safe Browsing for further analysis [1][4][6][8][9]. If Safe Browsing returns a dangerous verdict, Chrome displays a warning to the user, preventing the execution of the malicious command [1][4][6][8].

## Two Tiers of Site Warnings

Chrome has also introduced a new two-tier system for Safe Browsing site warnings within Enhanced Protection [1][4][8][9][10]. This system categorizes potentially harmful websites into 'Suspicious Sites' and 'Dangerous Sites' [1][3][4][8][9].

'Suspicious Sites' exhibit deceptive patterns with lower confidence, and warnings for these feature a distinct user interface to communicate the lower-confidence assessment [1][3][8][9][10]. This allows Chrome to expand warning coverage without treating every suspicious website as a confirmed threat [1][3][4][9][10]. For 'Dangerous Sites,' which are identified with high confidence as malicious, Chrome continues to display its familiar full-page red interstitial warning [1][3][4][8][9].

## Availability and Activation

These enhanced security features are exclusively available to users who have enabled Google Chrome's Enhanced Protection mode [1][3][4][6][11]. By 2025, over 1 billion Chrome users had already adopted this mode [4][6][9]. Users can enable Enhanced Protection within Chrome's settings by navigating to "Privacy and security" and then "Security" [3][11].

## What we could not confirm

It is not confirmed whether these new security features will also become available to Chrome users who have not enabled Enhanced Protection mode [1].

## Evidence cited
1. (October 22 2026) Chrome is introducing two new security features designed to catch online scams before users fall for them: a lower-severity warning for suspicious websites and a detector for malicious commands copied from scam pages. Google announced the changes on Oct. 20 as part of its Safe Browsing Enhanced Protection mode. The features use AI-assisted analysis to identify deceptive websites and ClickFix attacks, but Google has not confirmed that they will also become available to users rel (techrepublic.com) — https://techrepublic.com/
2. (October 22 2026) Google is expanding a browser security feature to all by default, giving you a chance to stop potentially unsafe connections before your browsing data is exposed. Join Our WhatsApp Channel · Business Today Desk. Noida,; Updated Oct 22, 2026 2:13 PM IST. Prefer Source Google Badge · Follow Google News Badge. Google Chrome will ask before opening HTTP websites, adding a new layer of security to Google Chrome will ask you before connecting to insecure HTTP websites to improve brow (businesstoday.in) — https://businesstoday.in/
3. (October 20 2026) Google is updating Chrome's Enhanced Protection mode to detect scam websites and warn users when a page tricks them into copying a malicious command. The company introduced Enhanced Protection for Chrome's Safe Browsing feature in 2020 to address online scams and social engineering. Google says further updates have made its users ten times safer from phishing, social engineering, notification abuse, and other scams compared with those using Standard Protection. The figure is ba (helpnetsecurity.com) — https://helpnetsecurity.com/
4. (October 21 2026) The company says page text is only analyzed when a site shows strong signs of being a scam. Any page content that leaves the device is handled ephemerally and is not logged, stored, or used to train AI models. In ClickFix attacks, victims are lured into pasting and running commands themselves. Those commands almost always invoke living-off-the-land binaries such as PowerShell. Since the malware download takes place in the terminal rather than the browser, Chrome and Safe Browsi (securityweek.com) — https://securityweek.com/
5. (October 21 2026) #1 Trusted Cybersecurity News Platform. Followed by 5.70+ million   · The Hacker News Logo... Get the Latest News. Home; Newsletter; Webinars · Home · Threat Intelligence · Vulnerabilities · Cyber Attacks · Webinars · Expert Insights · Awards.... Resources. Webinars · Awards · Free eBooks. About Site. About THN · Jobs · Advertise with us. Contact/Tip Us.. Reach out to get featured—contact us to send your exclusive story idea, research, hacks, or ask us a question or leave a com (thehackernews.com) — https://thehackernews.com/
6. (October 20 2026) In 2020, we launched the Enhanced Protection mode of Safe Browsing in Chrome to better address the increasingly sophisticated threats people face online. And now, more than 1 billion Chrome users are using this mode, making them two times as safe from phishing and other scams when compared to Safe Browsing's Standard Protection mode. Today, in honor of Safer Internet Day, here's a look at how Enhanced Protection mode works to keep you out of danger online. (blog.google) — https://blog.google/
7. (October 20 2026) Chrome today announced the latest features for Safe Browsing Enhanced Protection. Google says this mode makes users ten times safer from phishing, social engineering, notification abuse, and other scams compared to Standard Protection. (9to5google.com) — https://9to5google.com/
8. (October 21 2026) With this update, Chrome can now distinguish between suspicious sites and dangerous sites by flashing different warnings. The alert for a dangerous site paints the screen red and strongly recommends that you leave the page. The alert for a suspicious site is more subtle, giving you the option to still visit and use the site if you're certain it's legit. Also: Chrome stops hackers from stealing your browser cookies now. “Suspicious site warnings notify users when a page exhibits (zdnet.com) — https://zdnet.com/
9. (October 22 2026) Google Chrome Adds AI Scam Protection for More Than 1 Billion Users. Google Chrome adds Gemini AI scam detection and ClickFix malware warnings, bringing new security protections to more than 1 billion users. Written By. Matt Gonzales. Oct 22, 2026. · 6 minute read. eSecurity Planet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More. Google Chrome is getting new defenses against online scams that (esecurityplanet.com) — https://esecurityplanet.com/
10. (October 21 2026) Google has expanded Chrome's Enhanced Protection defenses with server-side Gemini analysis, suspicious-site warnings, and detection of malicious commands associated with ClickFix scams. Announced on October 20, 2026, the changes target deceptive websites that impersonate security products, promote fraudulent browser updates, or persuade users to execute malware-delivery commands themselves. The update builds on Google's earlier on-device Gemini, introduced in 2025 to identify t (cyberpress.org) — https://cyberpress.org/
11. (October 22 2026) If you use Google Chrome, you can turn on a new safety feature that will warn you if you navigate to a suspicious website that looks like others already known for malicious behavior. The alerts are part of Enhanced Protection mode in Chrome's Safe Browsing, which checks your activity against potentially harmful sites and warns you if you're at risk of encountering malware, phishing, intrusive ads, or social engineering attacks. (lifehacker.com) — https://lifehacker.com/
12. (August 14 2026) What Is a ClickFix Attack? A ClickFix attack is a social engineering technique in which a webpage shows a fake problem or verification step and convinces the visitor to run a malicious command on their own computer. This attack does not directly rely on malware and does not exploit a software vulnerability. The joint CISA advisory describes how attackers trick victims into executing a malicious payload under the guise of fixing an issue on the victim's system. Separate malware a (abnormal.ai) — https://abnormal.ai/
13. Background and Definitions. ClickFix and fake CAPTCHA schemes are social-engineered copy-and-paste attacks first observed in late 2023. Unlike malware that silently exploits a system, these attacks rely on user action to run malicious code. Victims are shown a plausible dialog or webpage, such as a browser verification prompt or fake error message, and are instructed to open the Run box or terminal and paste a command to "fix" an issue or "prove" they are human. In reality, the copied command do (phishingbox.com) — https://phishingbox.com/
14. ClickFix is a social engineering technique that uses a fake browser error, CAPTCHA, document prompt, or verification screen to convince someone to run a command on their own device. Instead of asking the victim to download “invoice.exe,” the page provides steps that appear to repair the issue. The instructions often direct the user to open Windows Run, PowerShell, Terminal, or another built-in utility. The attacker may quietly place a command on the clipboard, so the victim only has to paste and (doppel.com) — https://doppel.com/
15. (July 10 2025) ClickFix is a relatively new social engineering technique that threat actors increasingly use in attack campaigns. This technique misleads targeted users into applying “quick fixes” to common computer issues, such as performance issues, missing drivers or pop-up errors. In recent months, many of the lures using the ClickFix technique have been fake verification pages asking victims to complete an action before supposedly continuing to the viewer's intended destination. Threat acto (paloaltonetworks.com) — https://paloaltonetworks.com/
16. (September 29 2026) Consider this hypothetical scenario: An employee tries to join what looks like a routine video meeting. The page loads, but instead of the meeting, they see an error message along with a helpful fix: Copy the provided command, open the Windows Run dialog, paste it, and press Enter. The meeting never starts. The command does something else entirely. This is ClickFix, a social engineering technique that turns the victim into the mechanism for executing an attack. CrowdStrike In (crowdstrike.com) — https://crowdstrike.com/
17. (October 23 2026) Chrome now has a 'suspicious site' warning for pages that resemble known malicious sites. The familiar red full-page warning stays for sites known to be dangerous. Scam checks now use a server-side Gemini model for everyone with Enhanced Protection, covering fake antivirus and fake browser update pages, not just tech-support scams. Chrome also checks suspicious commands you copy from a page that says pasting them will 'fix' a problem. This trick is known as ClickFix. It warns y (digitaladvisors.com.au) — https://digitaladvisors.com.au/
18. (August 04 2026) It normally appears because Google Safe Browsing detected signs of phishing, malware, unwanted software, suspicious redirects or content added to the website without permission. Chrome red warning screen showing a dangerous site phishing alert. What the Warning Means. Chrome uses Google Safe Browsing to warn users before opening sites that could steal data, install dangerous software or trick people into sharing sensitive information. Chrome's full warning may show text like thi (mihosting.com) — https://mihosting.com/
19. (January 02 2026) If you've ever encountered a big red warning screen in Google Chrome that says “Dangerous site,” you're not alone. This warning can be alarming, especially if it appears on your own website or one you trust. But what does it mean? Why is Google flagging the site as dangerous, and how can you resolve this issue? Table of Contents. Google Chrome's “Dangerous Site” Warning: What It Means & How to Fix It. What Is the “Dangerous Site” Warning in Google Chrome? Why Is Your Website Ma (aveshost.com) — https://aveshost.com/
20. (October 21 2026) That Google is turning to Gemini to bolster its security offerings should come as no surprise. The company is shifting from on-device Gemini to server-side Gemini when users have the Enhanced Protection setting of Chrome enabled. It means that everyone now has access to a more up to date and powerful model which provides a higher chance of a scam site being successfully identified. Google says of the feature: This model evaluates page content to analyze key indicators, such as  (betanews.com) — https://betanews.com/
21. (October 21 2026) Google is introducing different colours, icons, wording and formatting to help users understand whether a website is suspected of being suspicious or has already been identified as dangerous. Websites confirmed as malicious will continue to trigger the existing full-page red warning, while less certain cases will receive a separate notification. This approach allows ... (techedt.com) — https://techedt.com/
22. (October 21 2026) Gemini is moving from on-device to server-side scam detection. Chrome previously used an on-device Gemini model to detect tech support scams, but it's now moving to a more powerful server-side model for Enhanced Protection users. As explained by Google, the model looks at signals such as the brand represented on a page, its intent, and how likely it is to be a scam. Safe Browsing then combines that analysis with domain reputation and other security signals. "Chrome minimizes th (bleepingcomputer.com) — https://bleepingcomputer.com/
23. (October 20 2026) Google has upgraded Chrome's Enhanced Protection mode with a more powerful Gemini AI model to detect fake antivirus alerts, browser update scams, and other deceptive websites. Announced on October 20, 2026, the changes also introduce suspicious site warnings and protection against ClickFix attacks that trick users into running malicious commands. The update expands Google's earlier work on AI scam detection. Chrome previously used an on-device Gemini model on supported devices  (cybersecuritynews.com) — https://cybersecuritynews.com/
24. (October 23 2026) Google adds Gemini AI security to Chrome to spot scams. Technology Oct 23, 2026. Google is rolling out new AI-powered security features for Chrome, aiming to keep you safer online. Thanks to the Gemini AI model working behind the scenes, Chrome can now spot tricky scams like fake antivirus pop-ups and sketchy browser update alerts. Plus, if you land on an insecure HTTP site, Chrome will give you a heads-up so you know what is up. ... Google issues Chrome 156 security patches. T (newsbytesapp.com) — https://newsbytesapp.com/
25. (October 21 2026) On October 20, 2026, Google announced new scam defenses for Chrome's Enhanced Protection feature. The update expands warnings for sites suspected of being dangerous and moves Gemini-based scam detection from an on-device model to a server-side model. It also adds protection against "ClickFix," a technique that displays fake repair instructions to trick users into running malicious commands. Chrome can now warn users at the moment a suspicious command is copied. Attackers can by (xenospectrum.com) — https://xenospectrum.com/
26. (October 24 2026) October 20, 2026: Google introduces suspicious-site warnings, server-side Gemini scam detection and ClickFix clipboard detection for Enhanced Protection users. Related PPC Land coverage. Chrome integrates Gemini AI with agentic browsing and enhanced security features - September 2025 coverage of Google's plan to extend Gemini Nano scam detection and cut spam notifications. Researcher finds Chrome installs a 4 GB Gemini Nano model on devices - the on-device model behind Chrome's (ppc.land) — https://ppc.land/
27. (October 20 2026) Google has enhanced Chrome's AI-powered scam defenses with a new server-side Gemini model that detects fake antivirus alerts, fraudulent browser updates, and other deceptive websites. Announced on October 20, 2026, these changes expand protection to all users who enable Safe Browsing's Enhanced Protection mode. This update builds on the earlier on-device Gemini integration introduced in 2025, which identified technical support scams on supported devices. By moving the analysis  (gbhackers.com) — https://gbhackers.com/