Google adds server-side Gemini AI to Chrome’s Enhanced Protection, targeting fake antivirus alerts and ClickFix command scams.
Key points
- Google announced the update on October 20, 2026.
- The feature requires Safe Browsing Enhanced Protection mode.
- It detects fake antivirus alerts and ClickFix attacks.
Google has upgraded Chrome’s scam detection with a new server-side Gemini model. This change helps identify fake antivirus alerts and browser update scams for users with Enhanced Protection enabled.
What happened
Google announced on October 20, 2026, that Chrome now uses a server-side Gemini model to detect deceptive websites. According to GBHackers, this update expands protection to all users who enable Safe Browsing’s Enhanced Protection mode. Previously, Chrome used an on-device Gemini model introduced in 2025 to identify technical support scams on supported hardware. Moving the analysis to the server allows broader device coverage and assessment of a wider range of scams, as reported by Cyber Security News.
Gemini analyzes page content to identify brands and assess intent, generating a scam likelihood score. Safe Browsing combines this with domain reputation data to issue a final verdict, meaning Gemini adds contextual analysis rather than making independent blocking decisions. Google states that Chrome limits server-side analysis to pages showing high-confidence scam indicators and that the content is ephemeral, not logged or used for training.
Chrome also introduces separate warning categories for suspicious and dangerous websites under Enhanced Protection. Suspicious warnings cover lower-confidence findings involving deceptive patterns, while dangerous verdicts trigger the familiar full-page red warning for known malicious sites. Additionally, Chrome now detects potentially malicious commands copied during ClickFix attacks, removing personally identifiable information before sending clipboard content to Safe Browsing for analysis.
Why it matters
AI models can analyze page context better than simple keyword filters. This helps catch scams that mimic legitimate branding. Teams usually rely on multiple signals to block threats. Checking whether Enhanced Protection is active ensures users get these advanced warnings. Understanding the difference between suspicious and dangerous alerts helps users make safer choices.
The fix
- Enable Safe Browsing Enhanced Protection mode in Chrome settings.
- Review new warning categories for suspicious versus dangerous sites.
- Be cautious when copying commands from web pages.
- Verify that clipboard data is stripped of personal info before analysis.
Why it matters
Modern browsers use layered defenses to protect users from social engineering. AI helps identify intent behind deceptive designs that traditional filters might miss. Users should understand that not all warnings mean immediate danger. Some indicate lower-confidence risks that require careful evaluation. Keeping Enhanced Protection on ensures access to these advanced detection capabilities. It also helps distinguish between confirmed threats and potentially deceptive pages. This distinction allows for more nuanced decision-making when browsing.
Background: Social engineering
Small organizations face unique social engineering risks due to limited staff and budget constraints. You can mitigate these threats by implementing strict verification protocols, training employees on manipulation tactics, and auditing third-party access rights with your IT provider.
Read the full guide: Social Engineering Risks and Protection for Small Businesses
What to do and how to stay safe: Google Chrome
- Enable Safe Browsing Enhanced Protection in Chrome settings to activate these AI defenses.
- Watch for new warning styles that indicate suspicious but not confirmed dangerous sites.
- Avoid copying and pasting commands from web pages into terminal windows.
- Check that your browser is updated to receive the latest scam detection improvements.
Step-by-step guide: What is password policies and how they protect systems
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does Gemini block websites on its own?
No, Gemini provides a scam likelihood score that Safe Browsing combines with other signals to reach a final verdict.
Is my page content stored when scanned?
No, Google states that content is processed temporarily and is not logged, retained, or used to train models.
Who gets these new protections?
All users who enable Safe Browsing’s Enhanced Protection mode receive the server-side Gemini analysis.
