Chrome's Enhanced protection detects suspicious commands copied as part of scams, sends them to Google after processing them to remove personally identifiable information, and warns users if they are dangerous. Gemini's analysis of scam pages has also moved to the server side.
Key points
- What it detects: Chrome's Enhanced protection detects suspicious commands copied through ClickFix scams and warns users if they are dangerous.
- What gets sent: Chrome processes suspicious copied content to remove personally identifiable information, then sends it to Safe Browsing to assess the risk.
- Broader scam detection: Gemini analyzes pages on the server side, expanding detection to scams involving fake antivirus software and browser updates.
- What users must weigh: Warnings about suspicious commands help users recognize danger, while the transmission of copied content to Google is another factor to consider when choosing a setting.
Checking suspicious commands as soon as they are copied
On October 20, 2026, local time, Google expanded Chrome's scam protections. Checks on copied commands apply to users who have enabled "Enhanced protection" in Chrome's Safe Browsing settings.
When Chrome detects a suspicious command being copied, it processes the content to remove information that could identify individuals and sends it to Google. If the command is judged dangerous, Chrome displays a warning.
Copying a command before executing it is now covered by these checks. Google says it designed the feature with an emphasis on precision to avoid disrupting legitimate command-line work by developers.
ClickFix is a scam technique that tricks users into copying and executing malicious commands themselves.
Why address actions outside the browser?
ClickFix prompts users to copy and execute commands under the pretext of fixing a nonexistent problem or completing a fake identity check. The command actually copied can differ from the text visible on the page.
Legitimate operating system programs, such as Windows PowerShell or cmd.exe, are abused. The command runs outside the browser. It can lead to malware being downloaded or launched without passing through the checks Chrome normally performs on file downloads.
In May 2026, researchers investigated ClickFix attacks (in Japanese) in which websites using the Ghost CMS publishing platform were compromised and fake human-verification pages directed visitors to execute commands.
Chrome's new detection targets the copy operation that occurs between a website's instructions and execution of an operating system command. Google cautions that Chrome never asks users to perform such actions to fix problems.
Different explanations for copied content and page text
Google's announcement says the check runs when an Enhanced protection user copies a suspicious command. It describes the detection and transmission of suspicious commands, rather than comprehensive collection of every copy operation or clipboard history.
Copied content is sent to a server after processing to remove personally identifiable information. In other words, deciding whether to show a warning involves sending the copied content outside the device. In this announcement, Google does not specify exactly what information it removes as personally identifiable or how long the transmitted commands are retained.
By contrast, Google says page text sent for Gemini's scam assessment is processed ephemerally, without logging, retention, or use in model training. This is an explanation about page text; it does not explicitly state whether the same retention policy applies to data transmitted from the clipboard.
Gemini analyzes scam pages on servers
In 2025, Google announced a system that ran Gemini Nano on supported devices in Chrome 137 to look for signs of fake technical support pages. It has now moved to a larger Gemini model running on servers.
The new model analyzes factors such as the company or service a page claims to represent, its purpose, and the likelihood that it is a scam. Joho no Todai confirmed that Safe Browsing makes the final decision, combining Gemini's analysis with factors such as the site's URL reputation.
This expands detection beyond fake technical support to scams impersonating antivirus software or browser updates. Google says the page text used for scam detection is sent to its servers only when a site shows strong signs of a scam.
Two warning levels, tied to Enhanced protection
Chrome is also changing its site warnings. It will show a new warning for sites suspected of being dangerous based on deceptive content or other signals. Sites classified as malicious with high confidence will continue to trigger a full-page red warning.
By distinguishing warnings about suspicious sites from those about dangerous sites, Google aims to flag more sites while conveying different levels of risk. These differentiated warnings also apply to Enhanced protection users.
Google's Japanese help page for desktop Chrome lists Safe Browsing's "Standard protection" as the default. Receiving warnings about suspicious copied commands requires enabling Enhanced protection.
Originally published on Joho no Todai. The Japanese original is here.
Top comments (0)