Chrome is adding a suspicious-site warning for people who turn on Safe Browsing’s Enhanced Protection. Google announced the change on October 20, alongside broader scam detection using a server-side Gemini model and a check for dangerous commands copied from web pages. The new warning signals a possible scam with lower confidence than Chrome’s familiar red dangerous-site screen.

The big change

  • What changed: Enhanced Protection now warns about lower-confidence suspicious sites as well as dangerous ones, using a different presentation. After Chrome finds high-confidence scam indicators, a server-side Gemini model examines page text; Safe Browsing weighs its analysis with domain reputation and other signals. A separate check examines copied commands.
  • Why it matters: Chrome can alert people to possible harm while reserving its full-page red interstitial for sites it judges dangerous. Google says the new tier allows more warnings. Users and administrators weighing Enhanced Protection must also consider the broader browsing data it sends to Google.
  • What to watch: The value of additional warnings turns on whether they help people avoid scams without repeatedly flagging legitimate pages or developer commands. Google has not published an independent evaluation of the warnings’ accuracy, false alarms or effect on scam losses.

Suspicious and dangerous mean different levels of confidence

Google calls a suspicious site a lower-confidence case with a possible risk of harm. It says the warning can appear when a page has deceptive patterns associated with known malicious sites. A dangerous-site verdict reflects higher confidence and higher risk; Chrome continues to show its full-page red interstitial for that tier. A suspicious warning therefore warrants caution, but the label alone does not establish that the page is malicious.

The distinction is available in Enhanced Protection, which users must select in Chrome’s Safe Browsing settings. Google’s Chrome help says Standard Protection is the default and covers sites already identified as dangerous. On a computer, the setting is under Settings → Privacy and security → Security → Safe Browsing. Workplace or school administrators may control it, according to Chrome’s warning guide.

Google says the new presentation lets it show more protective warnings. It has not disclosed how many additional sites will trigger one, the false-positive rate, or a measured reduction in successful scams. The company says Enhanced Protection users are “ten times safer” than Standard Protection users across several scam categories, but the footnote defines that figure by the average number of safety warnings shown to each group. Warning volume does not by itself measure whether users avoided harm.

Where Gemini enters the decision

Google says it moved from an on-device Gemini Nano system introduced for tech-support scams in 2025 to a server-side model intended to cover Enhanced Protection users more broadly. The model evaluates page content for signals including the represented brand, the page’s intent and a scam-likelihood score. Safe Browsing considers those outputs with domain reputation and other security signals for its final verdict. The announcement does not say that Gemini alone decides which warning a user sees.

The data path matters when choosing the setting. Google says Chrome sends page text for this analysis only when a site shows high-confidence scam indicators, and says content sent off the device is processed ephemerally, without logging, retention or model training. Those are Google’s stated handling practices; the announcement does not provide an independent audit of them. Chrome’s broader Enhanced Protection documentation says the mode sends site URLs, small samples of page content, extension activity and system information to Google Safe Browsing for security checks. The limited page-text trigger in the new scam flow should not be read as a promise that Enhanced Protection sends no other browsing data.

A clipboard check targets ClickFix instructions

In a ClickFix scam, a page tells someone to copy a supposed repair or verification command and run it on their computer. Microsoft’s threat description independently documents the tactic, including commands placed on the clipboard and instructions to execute them through Windows tools. Google says moving execution outside the browser bypasses its existing download protections.

Google says Chrome now detects when an Enhanced Protection user copies a potential ClickFix script. It says Chrome removes personally identifiable information from the clipboard payload before sending it to Safe Browsing for further analysis. If the service returns a dangerous verdict, Chrome shows a warning. The announcement does not specify the detection criteria, what information scrubbing removes, or a measured false-alarm rate. It describes a design goal of high precision, especially to avoid interrupting legitimate developer work.

For users, the strongest immediate signal remains the page’s request to paste and run a command to fix a browser problem. Google says Chrome will never ask for that kind of repair. The clipboard check and site warning add chances to catch the attempt, but Google has not shown that every ClickFix variant or deceptive site will be detected.

Sources & further reading