Chrome's New Gemini-Powered Scam Protections

Overview

Chrome is adding new scam defenses under Enhanced Protection in Safe Browsing. Google claims this mode makes users 10x safer from phishing, social engineering, notification abuse, and other scams compared with Standard Protection.

Key Changes

1. New "Suspicious Site" Warning

• Shown for pages with deceptive patterns commonly linked to known malicious sites, but that don't meet the confidence level needed for Chrome's existing full-page red warning.
• Its tailored, softer UI lets Google safely expand coverage and show more protective warnings.

2. Gemini Moves from On-Device to Server-Side

• Chrome previously used an on-device Gemini model to detect tech support scams.
• Enhanced Protection users now get a more powerful server-side model.
• The model analyzes the brand a page represents, its intent, and the likelihood it's a scam.
• Safe Browsing combines this with domain reputation and other security signals.

3. ClickFix Command Detection

• ClickFix attacks trick users into running malicious PowerShell or Command Prompt commands themselves.
• When Chrome suspects a ClickFix script has been copied:
  1. It strips personally identifiable information from the clipboard payload.
  2. It sends the payload to Safe Browsing for analysis.
  3. If judged dangerous, Chrome shows a warning before the user continues.

Privacy Safeguards

• Page text is analyzed only when a site shows high-confidence scam indicators, minimizing data shared.
• Any content sent off-device is processed ephemerally: never logged, retained, or used to train models.

Takeaway

Chrome is shifting toward proactive, AI-driven scam detection that covers both deceptive sites and the social-engineering trick of getting users to paste malicious commands, with the new warning tier broadening protection beyond high-certainty cases.

Source: Google Security Blog