Chrome’s Enhanced Protection Blocks Fake Antivirus Alerts and Copy-Paste Attacks
Google expands AI-driven scam detection to server-side analysis, offering broader coverage for users who enable advanced security settings in their browser.
Key points
- Google announced on 20 October 2026 that Chrome’s Enhanced Protection mode now uses a server-side Gemini model to detect deceptive websites.
- The update introduces distinct warning categories for suspicious sites versus known dangerous pages, helping users distinguish between potential and confirmed threats.
- New safeguards address ClickFix attacks by scanning clipboard content for malicious commands before they are executed in terminal applications.
Google has broadened the scope of its scam detection capabilities in the Chrome browser by shifting AI analysis from local devices to its own servers. This change allows more users to benefit from protection against fake antivirus alerts and fraudulent browser update prompts, provided they have activated the Enhanced Protection setting.
According to GBHackers, the announcement made on 20 October 2026 marks a significant expansion from earlier on-device models introduced in 2025. By moving the computational heavy lifting to the cloud, Google can assess a wider variety of deceptive tactics without relying on the processing power of individual user hardware.
What we know
The new system uses Gemini to analyse the text content of web pages that already exhibit strong indicators of malicious intent. Cyber Security News reports that the AI identifies the brand being impersonated, assesses the page’s underlying purpose, and generates a likelihood score for fraud. This contextual analysis is then combined with traditional domain reputation data to reach a final verdict.
Google states that it limits this server-side processing to pages showing high-confidence scam signals. The company emphasises that the text data used for analysis is ephemeral; it is not logged, retained, or employed to train future models. This approach aims to balance deeper security inspection with minimal data sharing.
Chrome now presents two distinct warning types for users with Enhanced Protection enabled. Suspicious warnings, which use different colours and icons, flag lower-confidence findings involving deceptive patterns. In contrast, the familiar full-page red warning remains reserved for known malicious sites that pose a high risk of immediate harm.
A critical addition targets ClickFix attacks, where victims are tricked into copying and pasting commands into terminal windows. These commands often use legitimate system utilities like PowerShell or cmd.exe to bypass standard browser download protections. Chrome now detects potentially malicious commands in the clipboard, stripping personally identifiable information before sending the data to Safe Browsing for evaluation.
Defender's checklist
- Verify that all managed devices have Safe Browsing Enhanced Protection enabled to access these new AI-driven features.
- Review internal policies regarding the execution of terminal commands, as ClickFix attacks bypass traditional browser sandboxing.
- Monitor for new warning categories in security logs, distinguishing between 'suspicious' and 'dangerous' site classifications.
- Ensure users are trained to recognise that copying and pasting code into system utilities can execute harmful actions.
The background in plain language
Browser security relies on combining multiple signals to judge whether a website is safe. Traditional methods check if a site has been previously reported as malicious. Modern AI adds a layer of understanding by reading the page’s text to spot deceptive language or fake branding. Server-side analysis means the checking happens on powerful computers owned by the browser maker, allowing for faster and more accurate assessments than what a single laptop or phone can perform alone.
Background: Personally identifiable information
Personally identifiable information acts as the anchor for security decisions. Without clear identification of this data, teams cannot prioritise risks, comply with regulations, or limit exposure during a breach. Proper classification transforms abstract data into actionable security controls, preventing widespread customer data exposure and reducing the blast radius of incidents.
Read the full guide: Why Personally Identifiable Information Defines Your Security Perimeter
What to do and how to stay safe: Google Chrome
- Enable Enhanced Protection in Chrome settings to ensure the latest AI detection models are active on your devices.
- Educate staff that copying commands from web pages into terminal applications like PowerShell is a high-risk activity.
- Watch for new warning styles in the browser, as distinct visual cues now indicate lower-confidence threats.
- Once the vendor provides further updates, review release notes for any changes to how clipboard data is handled.
General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does Chrome now block all fake antivirus sites automatically?
No, the system generates a scam likelihood score that Safe Browsing combines with other signals to reach a final verdict, rather than blocking sites independently.
Is my browsing data being used to train Google’s AI models?
Google states that page content processed for this specific detection feature is ephemeral and is not logged, retained, or used for model training.
What is a ClickFix attack?
It is a technique that tricks users into copying and executing commands in system utilities like PowerShell, which can bypass browser download protections to install malware.
