Markdown edition

# Chrome adds a suspicious-site warning for Enhanced Protection users

> Chrome now separates lower-confidence suspicious sites from known dangerous ones in Enhanced Protection. Google's Gemini scam analysis and ClickFix clipboard checks add detection, with server processing and privacy conditions users should understand.

By BIG CHANGE Editorial

Published: 2026-10-22T09:41:39.290Z
Updated: 2026-10-22T09:41:39.290Z
Canonical: https://bigchange.ai/blog/chrome-suspicious-site-warnings-enhanced-protection

![Conceptual charcoal illustration of a hand paused on a mouse beside a monitor showing a generic orange caution notice in a browser.](https://bigchange.ai/api/media/file/chrome-suspicious-warning-concept-hero-v1.png)
AI-generated conceptual illustration by BIG CHANGE.

Chrome is adding a **suspicious-site warning** for people who turn on Safe Browsing’s Enhanced Protection. Google [announced the change on October 20](https://blog.google/security/our-latest-defenses-against-evolving-web-scams/), alongside broader scam detection using a server-side Gemini model and a check for dangerous commands copied from web pages. The new warning signals a possible scam with lower confidence than Chrome’s familiar red dangerous-site screen.

## The big change

- **What changed:** Enhanced Protection now warns about lower-confidence suspicious sites as well as dangerous ones, using a different presentation. After Chrome finds high-confidence scam indicators, a server-side Gemini model examines page text; Safe Browsing weighs its analysis with domain reputation and other signals. A separate check examines copied commands.
- **Why it matters:** Chrome can alert people to possible harm while reserving its full-page red interstitial for sites it judges dangerous. Google says the new tier allows more warnings. Users and administrators weighing Enhanced Protection must also consider the broader browsing data it sends to Google.
- **What to watch:** The value of additional warnings turns on whether they help people avoid scams without repeatedly flagging legitimate pages or developer commands. Google has not published an independent evaluation of the warnings’ accuracy, false alarms or effect on scam losses.

## Suspicious and dangerous mean different levels of confidence

Google calls a suspicious site a **lower-confidence** case with a possible risk of harm. It says the warning can appear when a page has deceptive patterns associated with known malicious sites. A dangerous-site verdict reflects higher confidence and higher risk; Chrome continues to show its full-page red interstitial for that tier. A suspicious warning therefore warrants caution, but the label alone does not establish that the page is malicious.

The distinction is available in Enhanced Protection, which users must select in Chrome’s Safe Browsing settings. [Google’s Chrome help](https://support.google.com/chrome/answer/9890866?co=GENIE.Platform%3DDesktop&hl=en) says Standard Protection is the default and covers sites already identified as dangerous. On a computer, the setting is under **Settings → Privacy and security → Security → Safe Browsing**. Workplace or school administrators may control it, according to [Chrome’s warning guide](https://support.google.com/chrome/answer/99020?hl=en).

Google says the new presentation lets it show more protective warnings. It has not disclosed how many additional sites will trigger one, the false-positive rate, or a measured reduction in successful scams. The company says Enhanced Protection users are “ten times safer” than Standard Protection users across several scam categories, but the footnote defines that figure by the *average number of safety warnings shown* to each group. Warning volume does not by itself measure whether users avoided harm.

## Where Gemini enters the decision

Google says it moved from an [on-device Gemini Nano system introduced for tech-support scams in 2025](https://blog.google/security/using-ai-to-stop-tech-support-scams-in/) to a server-side model intended to cover Enhanced Protection users more broadly. The model evaluates page content for signals including the represented brand, the page’s intent and a scam-likelihood score. Safe Browsing considers those outputs with domain reputation and other security signals for its final verdict. The announcement does not say that Gemini alone decides which warning a user sees.

The data path matters when choosing the setting. Google says Chrome sends page text for this analysis only when a site shows high-confidence scam indicators, and says content sent off the device is processed ephemerally, without logging, retention or model training. Those are Google’s stated handling practices; the announcement does not provide an independent audit of them. [Chrome’s broader Enhanced Protection documentation](https://support.google.com/chrome/answer/9890866?co=GENIE.Platform%3DDesktop&hl=en) says the mode sends site URLs, small samples of page content, extension activity and system information to Google Safe Browsing for security checks. The limited page-text trigger in the new scam flow should not be read as a promise that Enhanced Protection sends no other browsing data.

## A clipboard check targets ClickFix instructions

In a ClickFix scam, a page tells someone to copy a supposed repair or verification command and run it on their computer. [Microsoft’s threat description](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Behavior%3AWin32%2FClickFix) independently documents the tactic, including commands placed on the clipboard and instructions to execute them through Windows tools. Google says moving execution outside the browser bypasses its existing download protections.

Google says Chrome now detects when an Enhanced Protection user copies a potential ClickFix script. It says Chrome removes personally identifiable information from the clipboard payload before sending it to Safe Browsing for further analysis. If the service returns a dangerous verdict, Chrome shows a warning. The announcement does not specify the detection criteria, what information scrubbing removes, or a measured false-alarm rate. It describes a design goal of high precision, especially to avoid interrupting legitimate developer work.

For users, the strongest immediate signal remains the page’s request to paste and run a command to fix a browser problem. Google says Chrome will never ask for that kind of repair. The clipboard check and site warning add chances to catch the attempt, but Google has not shown that every ClickFix variant or deceptive site will be detected.

## Sources & further reading

- [Google: Our latest defenses against evolving web scams](https://blog.google/security/our-latest-defenses-against-evolving-web-scams/): October 20, 2026 announcement of the warning tiers, server-side Gemini flow, data-handling claims and ClickFix clipboard check. Its “ten times safer” figure is defined in a footnote by warnings shown, not observed harm prevented.
- [Google Chrome Help: Choose your Safe Browsing protection level](https://support.google.com/chrome/answer/9890866?co=GENIE.Platform%3DDesktop&hl=en): current setting path, default Standard Protection and the broader data that Enhanced Protection sends for security checks.
- [Google Chrome Help: Manage warnings about unsafe sites](https://support.google.com/chrome/answer/99020?hl=en): dangerous-site warning and administrator-controlled settings context.
- [Google: Using AI to stop tech support scams in Chrome](https://blog.google/security/using-ai-to-stop-tech-support-scams-in/): May 2025 description of the earlier on-device Gemini Nano system and its narrower tech-support-scam scope.
- [Microsoft Security Intelligence: ClickFix threat description](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Behavior%3AWin32%2FClickFix): independent context for clipboard-based commands and the social-engineering step that asks users to execute them.

## Sources

- [Google Chrome Security, Our latest defenses against evolving web scams, October 20, 2026](https://blog.google/security/our-latest-defenses-against-evolving-web-scams/) — Primary source for the warning tiers, Enhanced Protection eligibility, server-side Gemini analysis, domain-reputation combination, ephemeral page-text processing, and ClickFix clipboard payload behavior.
- [Chrome Help, Choose your Safe Browsing protection level](https://support.google.com/chrome/answer/9890866?co=GENIE.Platform%3DDesktop&hl=en) — Standard/Enhanced setting, desktop path and categories of data sent under Enhanced Protection.
- [Chrome Help, Manage warnings about unsafe sites](https://support.google.com/chrome/answer/99020?hl=en) — Existing dangerous-site warning and work/school administrator control context.
- [Google Chrome Security, Using AI to stop tech support scams in Chrome, May 8, 2025](https://blog.google/security/using-ai-to-stop-tech-support-scams-in/) — Earlier on-device Gemini Nano system for tech-support scams, for historical comparison.
- [Microsoft Security Intelligence, Behavior:Win32/ClickFix](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Behavior%3AWin32%2FClickFix) — Independent description of clipboard-assisted social engineering and user-executed commands; does not evaluate Chrome's new control.