Google adds ClickFix and HTTP warnings to Chrome's Enhanced Protection

Past-week coverage · Original source published 2026-10-21.

Google has announced new Chrome protections against scams and social engineering, including a second tier of site warnings, server-side Gemini analysis and detection of ClickFix commands, SecurityWeek reported.

The Gemini and ClickFix features sit inside Enhanced Protection, the Safe Browsing mode Google introduced in 2020. Google says the mode makes users "ten times safer" than Standard Protection, a figure it bases on how many safety warnings each group of users receives on average.

Site warnings now come in two levels. High-confidence malicious pages still get the full-page red warning. A new "suspicious site" level covers lower-confidence verdicts and flags pages using deceptive tactics typical of known malicious sites. Google says the separate design lets it show more of them.

The Gemini scam model has moved from on-device to Google's servers and is now available to every Enhanced Protection user. It also targets fake antivirus and fake browser update pages. Google says page text is analyzed only when a site shows strong signs of a scam, and that content leaving the device is handled ephemerally and not logged, stored or used to train models.

ClickFix lures victims into pasting and running commands themselves, usually through living-off-the-land binaries such as PowerShell, so browser download protections never apply. Chrome can now spot when Enhanced Protection users are manipulated into copying a suspicious command: the clipboard payload is scrubbed of PII and sent to Safe Browsing, and a dangerous verdict triggers a warning. Google describes the system as high precision to limit disruption to developer work.

Separately, Chrome now asks for approval before connecting to a site over unencrypted HTTP, on by default for all users. The prompt appears on first visit and does not repeat until the user has not visited the site for at least two weeks. Hosts that can't obtain a publicly trusted HTTPS certificate, such as single-label hostnames and local IP addresses, don't trigger warnings by default.

Google says early rollout figures show nearly 95% of desktop Chrome users see no HTTP warnings in a given week, while under 1% see three or more. Mobile users see them less often. Google says Chrome is the first browser to take this approach.

For defenders, the practical read is that browser-side signals now cover a step that previously fell outside download scanning. Organizations that manage Chrome policy should check whether Enhanced Protection is enabled and whether the HTTP prompt fits existing user guidance.