Google Chrome Enhances Scam Detection with Gemini Technology
Google Chrome is introducing new scam detection features that utilize Gemini technology to identify deceptive websites and warn users about suspicious commands associated with ClickFix attacks.
These updates are part of the Enhanced Protection in Safe Browsing, which Google claims increases user safety against phishing, social engineering, notification abuse, and other scams by ten times compared to Standard Protection.
Additionally, Chrome will implement a new “suspicious site” warning for pages that exhibit deceptive patterns but do not meet the criteria for the existing full-page red warning.
Google explained, “Suspicious site warnings notify users when a page exhibits deceptive patterns commonly associated with known malicious sites.” The company aims to expand its protective coverage by adjusting the warning interface.
Previously, Chrome relied on an on-device Gemini model to detect tech support scams. It is now transitioning to a more robust server-side model for users with Enhanced Protection.
According to Google, this model evaluates various signals, including the brand represented on a webpage, its intent, and the likelihood of it being a scam. Safe Browsing then combines this analysis with domain reputation and other security indicators.
Google noted that Chrome minimizes data sharing with the server by analyzing page text only when a site shows high-confidence scam indicators. Furthermore, any page content sent to the server is processed temporarily, ensuring it is not logged or retained for model training.
Enhanced Protection also enables Chrome to detect when users copy suspicious commands from ClickFix scams, which often trick them into executing harmful PowerShell or Command Prompt commands.
If Chrome identifies a potential ClickFix script, it removes personally identifiable information from the clipboard before sending it to Safe Browsing for analysis. If deemed dangerous, Chrome will display a warning before the user proceeds.
Overall prevention scores may not fully reflect the situation after initial access. Once attackers have valid credentials, prevention effectiveness drops significantly.
The Blue Report 2026 assesses defense techniques across 338 million simulations conducted in customer production environments.
Source: BleepingComputer