Google announced new Chrome protections against phishing and social engineering, including new website warnings, server-side Gemini analytics, and ClickFix command detection.
Gemini Protection and ClickFix are part of the improved protection, the Safe Browsing model that Google introduced in 2020. Last year, the company said that more than 1 billion Chrome users had it turned on.
Google claims the enhanced protection makes users “ten times safer” than standard protections against phishing, social engineering, notification abuse, and other scams. The metric is based on the number of security warnings, on average, each group of users receives.
Chrome’s Safe Browsing site warnings now have two levels, mirroring the model previously used for file downloads. When Safe Browsing is highly confident that a web page is dangerous, users are also given a full-page red ‘dangerous website’ warning.
The new level ‘questionable website’ covers the judgment of low confidence. It reports pages using typical phishing tactics of known malicious sites. Because these warnings have their own design, Google says it can safely display more of them.
Fraud detection using Gemini has also moved to Google servers. The in-device version launched last year focuses on fraud technology and is limited to users with improved protection on supported devices.
A more capable server-side mode is now available to users with improved protection. It also targets additional threats, such as fake antivirus and fake browser update pages.
Reviewing the page model looks at signals such as the brand displayed, the purpose of the page, and the likelihood of fraud score. “Safe Browsing then considers the Gemini analysis, combined with domain reputation and other security signals, to make a final decision,” Google explained.
The company says the text on the page is analyzed only when the website shows strong signs of fraud. Any page content that leaves the device is handled anonymously and is not recorded, stored or used to train AI models.
In the ClickFix attack, victims are lured into placing and executing commands themselves. Those commands almost always call an external binary such as PowerShell. Since malware downloads happen more in the browser than in the browser, Chrome’s download protection and Safe Browsing have never been better.
Chrome can now detect when Advanced Protection users are manipulated into copying suspicious commands. “If a potential ClickFix script is copied, the clipboard load is scrubbed of PII and sent to Safe Browsing for further analysis, and if a malicious verdict is returned, Chrome displays a warning,” Google said.
“This system is designed to be highly accurate, to protect users in real time while minimizing disruption to legitimate developer activities,” the company added.
Chrome now asks before connecting via HTTP
Chrome now also prompts users for approval before it connects to a website via unencrypted HTTP. Enhanced protection users got the feature earlier this year. As promised last year, Google has now Turn it on by default for everyone.
According to Google, the ‘Not Secure’ label alone is short. Research shows that passive indicators such as that can be observed, and short-term HTTP traffic such as redirects never receive a label at all. The bigger problem, the company says, is that the label only appears when a user’s data and connections have been exposed.
A warning is shown on the first visit to the HTTP site. “Once HTTP usage is approved, Chrome won’t prompt again until the user hasn’t visited the site for at least two weeks,” Google noted.
By default, websites that cannot obtain a publicly trusted HTTPS certificate will not trigger a warning. Examples include single label hostnames and local IP addresses. Google says these hosts are generally low-risk, because attackers would need to be on the same local network to intercept traffic.
Early release numbers show that nearly 95% of Chrome desktop users don’t see any HTTP prompts during any given week, while less than 1% see three or more. Mobile users see warnings less often.
Google notes that Chrome is the first browser to use this approach and says it hopes others will follow its lead.
Related: Chrome 153 Patches Seventh Zero-Day of 2026
Related: Chrome, Firefox update Patch 114 bug when Mozilla unveils Firefox Enterprise
Related: Google Rejects Some of the Chrome Bug Bounty Cuts
