Chrome today announced the latest features for Safe Browsing Enhanced Protection. Google says this mode makes users ten times safer from phishing, social engineering, notification abuse, and other scams compared to Standard Protection.
Chrome is adding suspicious site warnings in the address bar “when a page exhibits deceptive patterns commonly associated with known malicious sites.” There are two tiers:
- Suspicious sites (lower confidence verdict, possible risk of user harm)
- Dangerous sites (high confidence verdict, high risk of user harm)
Suspicious sites (above) will trigger a shield icon in the Omnibox, with a dialog box letting you “Mark as safe” or go “Back to safety.”
Dangerous site alerts (below) will continue to appear as a “full-page red interstitial warning.”
Meanwhile, Chrome is continuing to boost scam detection by leveraging Gemini models in the cloud after using on-device approaches. This protects Enhanced Protection users from a broader range of threats, including fake antivirus and browser update scams.
This model evaluates page content to analyze key indicators, such as the brand represented, the intent of the page, and a scam likeliness score, giving us rich threat data needed to identify deceptive sites.
Safe Browsing uses the Gemini analysis “in combination with domain reputation and other security signals.” Google will process page content ephemerally, “meaning it is never logged, retained, or used to train models.”
The final Enhanced Protection update defends against ClickFix social engineering that “tricks users into manually copying and executing malicious commands on their own computers in order to ‘fix’ a fake issue.” In reality, this is used to “carry out malicious actions such as downloading and setting up malware.”
Because these utilities are native to the system and trusted by security software, bad actors use them to blend in and hide their activity, and by shifting the download process out of the browser and into the terminal, attackers completely sidestep existing Chrome and Safe Browsing download protections.
When a potential ClickFix script is copied, Chrome will remove personally identifiable information from the clipboard and send it to Safe Browsing for further analysis. The browser shows a warning if a “dangerous verdict is returned.”
This system is designed to be high precision, in order to protect users in real time while minimizing disruption to legitimate developer activity.
Enhanced Protection was introduced in 2020, and Google said it was enabled by 1 billion users in 2025. It can be enabled in Chrome Settings > Privacy and security > Security.
You’re reading 9to5Google — experts who break news about Google and its surrounding ecosystem, day after day. Be sure to check out our homepage for all the latest news, and follow 9to5Google on Twitter, Facebook, and LinkedIn to stay in the loop. Don’t know where to start? Check out our exclusive stories, reviews, how-tos, and subscribe to our YouTube channel
