Chrome’s Enhanced Protection targets copy-and-run scam tactics
Google is enhancing Chrome’s Enhanced Protection to identify fraudulent sites and alert people when a page tries to get them to copy and execute harmful commands. The update adds tailored warnings for suspicious pages and keeps full-page red warnings for known dangerous sites. Gemini-based scam detection now runs server-side for Enhanced Protection users and covers fake antivirus, browser update, and tech support schemes, with ClickFix-style attacks specifically targeted.
Chrome’s Enhanced Protection, introduced in 2020 within Safe Browsing, is being adjusted to counter social-engineering scams. Google attributes a tenfold safety improvement over Standard Protection to this mode, based on how many warnings each displays on average. New suspicious-site alerts use customized layouts and wording to widen coverage, while confirmed dangerous pages still show the red full-page warning.
For Enhanced Protection users, Gemini-powered scam checks now run on servers instead of on-device and cover fake antivirus, browser update, and tech support schemes. Page text is examined only when scam signals are strong, without logging or model training. Chrome also inspects copied commands, removes personal data, and warns if ClickFix-style instructions appear dangerous.
This change could reduce harm from copy-and-run scams by adding warnings at the moment a user is about to paste a command, helping less technical users and anyone following fake troubleshooting instructions. Server-side checks may improve detection coverage, but they also mean page text and copied commands are sent for analysis under stated privacy limits. The benefit may be strongest for people targeted by fake tech support or browser-update scams, while cautious users still need to verify instructions.