Google announced new defenses in Chrome that target fraudulent sites and attacks that direct the user to run malicious commands. The announcement, dated October 20, includes Gemini analysis and ClickFix command control running on the server, as well as suspicious site warnings. A common requirement for these protections is to turn on Safe Browsing’s Advanced Protection option in Chrome.
According to Google’s statement, the browser now treats suspicious and dangerous sites with different warnings. Suspicious site determination covers cases where deceptive patterns are seen but the trust level remains lower. For known malicious sites, the full-screen red warning that users recognize continues. Thus, it becomes more apparent that not every warning means a threat detection with the same accuracy.
The company states that it differentiates the format, icons, colors and text for suspicious sites. This distinction aims to show low-confidence findings to the user. The decision that a page is definitely harmful and the warning that it exhibits suspicious behavior should not be evaluated under the same heading.
Gemini analysis moves to server, dashboard control comes for ClickFix
Google says it is moving from the on-device Gemini layer it uses to combat tech support fraud on supported devices to a more powerful, server-side model. The goal is to reach all users who have Advanced Protection turned on and evaluate broader types of attacks, such as rogue antivirus and browser updates. The model examines the brand the page represents, its purpose, and the possibility of fraud. Safe Browsing makes its decision by combining this analysis with the domain reputation and other security signals.
This process does not mean that the text of every visited page is constantly sent to the server. Google explains that it only analyzes text when it sees signs of highly secure fraud. According to the company, content sent outside the device is processed temporarily; It is not recorded, stored or used in model training.
ClickFix, on the other hand, is a social engineering method that shows the user a fake problem and asks him to run commands on his computer. These attacks can bypass the browser’s download controls by moving the download from the browser to system tools. When an Advanced Protection user copies a suspicious command, Chrome extracts personally identifiable information from the clipboard content and sends the command to Safe Browsing for additional review. If a dangerous decision is made, it shows a warning.
The practical distinction here is that protection depends on the setting. It doesn’t follow that everyone who uses Standard Protection automatically gets these new layers. Google redirects to instructions for enabling Advanced Protection. The fact that a fake verification or repair page asks you to paste a command into the terminal is still a sign that you should stop and check.