Chrome Uses Gemini to Spot Scams: New Warnings for Suspicious Sites and Dangerous Copied Commands
Scams are getting more convincing, and your web browser is trying to keep up. On October 20, 2026, Google announced new scam defenses for the Enhanced Protection setting in Chrome. XenoSpectrum summarized the announcement on October 21. The update uses Google's Gemini AI to look at suspicious pages, adds a gentler kind of warning, and tries to catch a trick called ClickFix before it can hurt you.
Two kinds of warnings: Suspicious and Dangerous
Chrome now splits website warnings into two levels. Sites that Chrome is highly confident are malicious still get the full screen red Dangerous warning. The new Suspicious warning appears when Chrome sees deceptive patterns common on known malicious sites, but does not have enough evidence to call the site dangerous.
The two warnings look different in format, icon, color and wording, so you can tell how serious the risk is. The idea is that a mild warning for a questionable site is more useful than either nothing or an alarm that treats every site the same. XenoSpectrum notes that Google did not share a false positive rate for the new Suspicious level, so expect to see some cautious flags on sites that turn out to be fine.
Gemini now helps spot fake pages
The biggest change is how Gemini is used. In 2025, Google used a small Gemini Nano model on your device to detect tech support scams. The new approach uses a more capable Gemini model running on Google's servers. That extends AI detection beyond supported devices to everyone who has Enhanced Protection turned on, and it adds coverage for scams that pretend to be fake antivirus software or browser updates.
The model looks at which company or brand a page is pretending to be, what it is trying to get you to do and how likely it is to be a scam. Google Safe Browsing then combines that with other signals, such as the reputation of the website's domain, before deciding whether to warn you.
What is ClickFix, and how does Chrome stop it?
ClickFix is a social engineering trick. A website shows a fake error or security message and tells you that to fix the problem you must copy a command and run it on your computer. The command is often meant for tools built into Windows, such as PowerShell. Because you run it yourself, the malware can download outside the browser, where Chrome's normal download protections do not reach.
To counter this, Chrome's Enhanced Protection can now detect when you copy a suspicious command. XenoSpectrum reports that Chrome removes personal information from the copied text and sends it to Safe Browsing for analysis. If the command looks dangerous, Chrome warns you before you paste it anywhere. It is a warning, not a guaranteed block, and it does not clean up a computer that has already run a bad command.
The privacy trade-off
Better detection comes with a trade-off. For the Gemini page analysis, Google says it sends page text to its servers only when it sees signs of a scam with high confidence, processes it temporarily, and does not log it, store it or use it to train AI models. XenoSpectrum points out that Enhanced Protection as a whole shares more data with Google than the default setting does, including the web addresses you visit and some page content. Google also has not said how long the copied command data is kept.
Google claims Enhanced Protection users are ten times safer than Standard Protection users against scams. The footnote says that figure compares the average number of safety warnings shown, not actual losses, so treat it as marketing rather than proof.
What you should do
Standard Protection is Chrome's default, and these new features apply to people who turn on Enhanced Protection. On desktop Chrome, you can find the setting under Settings, then Privacy and security, then Security. Weigh the extra protection against the extra data sharing and choose what fits you. For many families and small business owners who handle money online, the added protection is worth considering.
Whatever your setting, a few habits beat any software. Never copy and run a command from a website to fix a problem. Be wary of any page that says your computer is infected or your browser is out of date. When a message creates urgency, slow down and go directly to the real company's website instead.
Source: XenoSpectrum, "Chrome Adds Scam Warnings for Suspicious Sites and Malicious Copied Commands," published October 21, 2026, reporting on Google's announcement of October 20, 2026.
Worried about scams hitting your family or your team? Net Nerds can help with your technology and security needs, and Dean Isenberg is available to speak at your event about staying safe with AI. Visit netnerds.com to get started.
