Google is moving Chrome’s protection earlier, stopping risky commands and unencrypted connections before the damage is done
Google has announced a set of Chrome updates aimed at scams, social engineering and unencrypted web traffic. They include a new tier of site warnings, a more powerful Gemini-based scam detector and protection against ClickFix attacks. Separately, Chrome now asks for permission before connecting to a site over plain HTTP, and this is on by default for all users.
What’s new in Enhanced Protection
The scam-related changes are part of Enhanced Protection, the stricter Safe Browsing mode Google launched in 2020. Google said last year that more than one billion Chrome users had it turned on. It now claims Enhanced Protection users are ten times safer than Standard Protection users against phishing, social engineering, notification abuse and other scams. That figure compares the average number of safety warnings shown to each group.
Two levels of site warnings. Chrome’s site warnings now follow a two-tier model already used for downloads. A “dangerous” verdict means Google is highly confident a page is malicious, and users still see the full-page red warning. A new “suspicious” verdict covers lower-confidence cases, where a page shows deceptive patterns common to malicious sites. The two warnings differ in design, icons, colour and text. Google says this lets it show more protective warnings without overusing the most severe one.
Gemini moves to the server. Last year Chrome introduced an on-device Gemini feature to catch tech-support scams, limited to Enhanced Protection users on supported devices. Google has now replaced it with a more powerful server-side Gemini model, available to every Enhanced Protection user. It also covers fake antivirus and fake browser-update scams. The model assesses the brand a page imitates, the page’s apparent intent and a scam-likelihood score. Safe Browsing combines that with domain reputation and other signals to reach a verdict.
On privacy, Google says Chrome analyses page text only when a site already shows strong scam indicators. Any content sent off the device is processed ephemerally. It is not logged, retained or used to train models.
A defence against ClickFix. ClickFix attacks trick people into copying a command and running it themselves, usually to “fix” a fake problem. The command often differs from what the page displays, and it typically calls built-in system tools such as PowerShell or cmd.exe to download malware. The download happens in the terminal rather than the browser, so Chrome’s usual download protections never get a chance to act.
Chrome can now recognise when an Enhanced Protection user copies a suspicious command. The clipboard content is stripped of personal information and sent to Safe Browsing. If the verdict is dangerous, Chrome shows a warning. Google says the system is built for high precision so it doesn’t disrupt legitimate developer work.
Chrome now asks before using HTTP
Chrome now asks users to approve a connection before it is made over unencrypted HTTP. Enhanced Protection users got this earlier in 2026, and Google has now turned it on by default for everyone, as it promised last year.
Google says the “Not Secure” label on its own is not enough. Users can overlook such passive indicators, short-lived HTTP traffic like redirects never gets the label, and the label appears only after data has already been exposed.
The prompt appears on a first visit to an HTTP site. Once the user approves, Chrome doesn’t ask again until they have stayed away from the site for at least two weeks. Sites that can’t get a publicly trusted HTTPS certificate, such as single-label hostnames like “intranet” or local IP addresses like 192.168.0.1, don’t trigger warnings by default. Google notes these carry lower risk, since an attacker would need to be on the local network.
Early rollout data shows that nearly 95% of desktop Chrome users see no HTTP warning in a given week, and fewer than 1% see three or more. Mobile warning rates are lower still. Google says Chrome is the first browser to take this step and hopes others will follow.