Chrome Gemini Scam Detection: What the New Warnings Mean

Chrome just got a smarter set of eyes for spotting web scams. In a post dated October 20, 2026, Google's Chrome team explained that Gemini scam detection has moved from a small on-device model to a more powerful server-side Gemini model, and that it now covers every Chrome user who has turned on Safe Browsing's Enhanced Protection mode. Alongside it come two new defenses: a softer "suspicious site" warning and a guard against ClickFix attacks that trick people into pasting malicious commands.

• Gemini scam detection: now server-side and available to all Enhanced Protection users, covering fake antivirus and fake browser-update pages as well as tech support scams
• New warning tier: "Suspicious site" for lower-confidence verdicts, alongside the familiar full-page red "Dangerous site" warning
• ClickFix protection: Chrome checks suspicious commands you copy, after scrubbing personal data, and warns you if the verdict is dangerous
• Scale: Google says more than 1 billion Chrome users had Enhanced Protection on as of 2025

What Is Changing in Chrome's Scam Protection?

Last year, Chrome added an on-device Gemini model that watched for tech support scams, the pop-ups that claim your PC is infected and push you to call a fake help line. Google says that experiment worked well enough to prove that LLM-assisted detection is viable, so it has now graduated to a larger server-side model.

According to Google, the model reads key signals on a page: which brand the page claims to represent, what the page is trying to get you to do, and a scam likeliness score. Safe Browsing then blends that analysis with domain reputation and other security signals to reach a final verdict. BleepingComputer and SecurityWeek both report the same design, and both note the wider scope: fake antivirus and fake browser-update pages are now in the net too.

Does Gemini Read Every Page I Visit?

No, and this is the part I would want to know first. Google says Chrome only sends page text for analysis when a site already shows high-confidence scam indicators. Any content that leaves your device is processed ephemerally, which Google defines as never logged, never retained and never used to train models. That is a sensible trade: the heavy model only wakes up when the cheaper signals already look bad.

Suspicious vs Dangerous Site Warnings

Chrome now uses a two-tier system for site warnings, mirroring the one it already uses for downloads:

• Suspicious site: a lower-confidence verdict, shown when a page uses deceptive patterns common to known malicious sites. It has its own color, icon and wording, so it reads as a caution rather than a stop sign
• Dangerous site: a high-confidence verdict that a page is malicious. This stays as the full-page red interstitial many people already recognize

Google says the softer design lets it safely show more protective warnings without crying wolf on the big red screen.

How Chrome Stops ClickFix Attacks

ClickFix is a social engineering trick that asks you to "fix" a fake problem by copying a command and running it yourself, often in PowerShell or the Windows command prompt. Because the malicious download then happens in the terminal instead of the browser, it sidesteps Chrome's download protections entirely.

Chrome now notices when an Enhanced Protection user copies a suspicious-looking command. The clipboard contents are scrubbed of personally identifiable information and sent to Safe Browsing for a verdict, and Chrome shows a warning if that verdict comes back dangerous. Google says the check is tuned for high precision so developers copying legitimate commands are not constantly interrupted. If you want the wider picture of how these lures work on phones too, our look at Android scam protection in Google Messages covers Google's mobile side.

How to Turn On Enhanced Protection

All three features depend on Enhanced Protection. In Chrome, open Settings, then Privacy and security, then Security, and select Enhanced protection. Google says Enhanced Protection users are ten times safer from phishing, social engineering and other scams than Standard Protection users, a figure it calculates from the number of safety warnings each group sees. SecurityWeek also notes a separate change: Chrome now asks before connecting to sites over unencrypted HTTP, on by default for everyone.

For more defensive tooling news, browse our AI security coverage, including how Chrome's Gemini bug hunter found a 13-year-old flaw.

Sources: Google Blog: Our latest defenses against evolving web scams — October 20, 2026; BleepingComputer — October 21, 2026; SecurityWeek — October 21, 2026.