Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections

What it is

Google added new scam and social engineering protections to Chrome. Most are limited to Enhanced Protection, the Safe Browsing mode introduced in 2020, which Google said more than 1 billion Chrome users had turned on as of last year. The exception is a prompt before HTTP connections, now on by default for all users. The page gives no Chrome version numbers or release dates for any of these changes.

How it works

ClickFix detection. ClickFix attacks trick victims into pasting and running commands themselves, usually through living-off-the-land binaries such as PowerShell. The malware download happens in the terminal, so Chrome and Safe Browsing download protections never see it. Chrome now notices when an Enhanced Protection user copies a suspicious command. The clipboard payload is scrubbed of PII and sent to Safe Browsing. If the verdict is dangerous, Chrome shows a warning. Google calls the system "high precision" and says it aims to avoid disrupting legitimate developer activity.

Server-side Gemini analysis. The earlier on-device model covered tech support scams on supported devices only. The server-side model is available to every Enhanced Protection user and adds fake antivirus and fake browser update pages. It reviews the displayed brand, the page's purpose and a scam likelihood score. Safe Browsing combines that with domain reputation and other signals to produce the final verdict. Google says page text is analyzed only when a site shows strong signs of being a scam, and that content leaving the device is handled ephemerally, with no logging, storage or AI training use.

Two-level site warnings. The full-page red "dangerous site" warning stays for high-confidence verdicts. A new "suspicious site" level covers lower-confidence verdicts for pages using deceptive tactics typical of known malicious sites. Google says the separate design lets it show more of these warnings safely.

HTTP prompt. Chrome asks for approval on the first visit to an HTTP site. After approval it does not warn again until the user has not visited the site for at least two weeks.

Preconditions / Affected

• ClickFix detection, server-side Gemini analysis and the "suspicious site" level are described as Enhanced Protection features. Standard Protection users are not stated to get the first two.
• The HTTP prompt applies to everyone. Enhanced Protection users have had it since earlier in 2026.
• By default there is no HTTP warning for hosts that cannot get a publicly trusted HTTPS certificate, such as single-label hostnames and local IP addresses. Google reasons that an attacker would need to be on the same local network.

What to do

The page lists no commands or settings paths. For teams, the relevant decision is whether to move users to Enhanced Protection, since the ClickFix and Gemini coverage depends on it. Internal HTTP tools on public hostnames will now prompt on first visit, while single-label and local IP hosts will not by default.

Caveats

• The "ten times safer" claim for Enhanced Protection is Google's own, based on the average number of safety warnings each user group receives.
• Google's early HTTP rollout figures: nearly 95% of desktop users see no HTTP warnings in a given week, and under 1% see three or more. Mobile users see fewer.
• ClickFix detection sends clipboard contents, after PII scrubbing, to Safe Browsing. Developers who copy commands should expect this when Enhanced Protection is on.
• Google says Chrome is the first browser to take the HTTP prompt approach and hopes others follow.