Artificial Intelligence
Chrome adds Gemini scam detection
Google said Chrome would use Gemini to flag deceptive pages and suspicious copied commands, while adding a lower-severity warning for sites that look risky but do not trigger the full-page alert.
- Google said Chrome would use Gemini to detect deceptive websites and to warn users about suspicious commands copied during ClickFix attacks.
- The company said the changes were part of Enhanced Protection in Safe Browsing and claimed that mode was ten times safer than Standard Protection against phishing, social engineering, notification abuse and other scams.
- Chrome also added a suspicious site warning for pages that showed deceptive patterns without meeting the threshold for the existing full-page red warning.
- Google said the Gemini model had moved from on-device processing to a server-side model for Enhanced Protection users, and that page text would only be analysed when high-confidence scam indicators were present.
- When Chrome suspected a ClickFix script, it removed personally identifiable information from the clipboard payload before sending it to Safe Browsing for analysis. If the result was dangerous, it showed a warning before the user continued.
Google said Chrome was gaining new scam protections that used Gemini to identify deceptive sites and to warn users when they copied suspicious commands linked to ClickFix attacks. The changes were tied to Enhanced Protection in Safe Browsing.
The company said that mode made users ten times safer than Standard Protection against phishing, social engineering, notification abuse and other scams. It also said the new warning design would let Chrome show more protective alerts.
Chrome also got a new warning for pages that looked deceptive but did not meet the threshold for the browser’s existing full-page red alert. Google said the warning was meant for sites that showed patterns associated with known malicious pages.
Google said the Gemini scam detector had moved from an on-device model to a server-side model for Enhanced Protection users. It said Safe Browsing combined that analysis with domain reputation and other security signals.
For suspected ClickFix scripts, Chrome removed personally identifiable information from the clipboard payload before sending it for analysis. If Safe Browsing judged it dangerous, the browser displayed a warning before the user could continue.
Named in this story
Companies
- announced the new Chrome and Safe Browsing protections
Products and systems
- Chrome
- gained Gemini-based scam detection and new warnings
- Gemini
- powered the scam detection model
- Safe Browsing
- combined model analysis with reputation and security signals
- Enhanced Protection
- received the new scam protections
- Standard Protection
- served as Google’s comparison point
- ClickFix
- the attack pattern Chrome now tries to detect when users copy commands
- PowerShell
- one of the command shells used in the scam flow
- Command Prompt
- another command shell used in the scam flow
How the source tells it
Mostly matter-of-fact product reporting, with brief vendor boosterism and privacy reassurance in Google’s own claims.
- vendor boosterism Google’s self-comparison to Standard Protection and emphasis on a more capable model
- reassurance privacy assurances about limited analysis and ephemeral processing