Picture the scam. You land on a page that looks like a routine robot check, except this one says the check failed. It tells you to press a few keys, paste something into the Windows Run box or a terminal, and hit Enter. There is no file for your browser to scan. You do the work yourself, and whatever you just ran does the rest.
That is called ClickFix, and Google says Chrome is getting a defense against it. In a post published October 20, Chrome group product manager Jasika Bawa described three changes to Enhanced Protection, the stricter tier of Safe Browsing.
Why ClickFix slips past normal defenses
According to Google, the trick is to get you to copy a command and run it through built-in system tools such as PowerShell or cmd.exe. Because the payload arrives through your own keystrokes instead of as a download, Chrome’s usual download protections never get a look at it. The fake problem can be anything: a broken captcha, a missing driver, a document that supposedly will not open.
What Chrome is adding
All three changes are for people who have Enhanced Protection switched on.
The first is a clipboard check. When you copy a command that looks suspicious, Chrome removes personal information from the clipboard content and sends the rest to Safe Browsing. If the verdict is dangerous, you get a warning. Google says the system is built for high precision so it does not nag developers who copy terminal commands all day. That is Google’s claim, and it is the part I would watch once real users get it, because false alarms on legitimate commands would train people to click past warnings.
The second is a stronger scam detector. Last year Chrome added on-device Gemini analysis aimed at tech-support scams on supported devices. Google says it has now moved to a more powerful server-side Gemini model for all Enhanced Protection users, and the model also covers fake antivirus and fake browser-update pages. Per the post, it weighs which brand a page is pretending to be, what the page wants you to do, and a scam-likelihood score, then Safe Browsing combines that with domain reputation and other signals. Page text is sent only when a site shows high-confidence scam indicators, and Google says it is processed ephemerally, not logged, not retained and not used for model training.
The third is a second warning tier. Dangerous sites keep the full-page red warning. A new Suspicious label covers lower-confidence cases, with different icons, colors and wording so you can tell the two apart. Google says the split lets Chrome show more warnings without overstating the risk.
What Google has not said
The announcement gives no rollout dates, regions or platform timelines, only that the features were introduced in 2026. It also does not say whether the new server-side model has device limits like the on-device version did. If you do not see the new warnings yet, that is not necessarily a sign anything is wrong.
The headline number deserves a careful read too. Google says Enhanced Protection users are ten times safer from phishing, social engineering and similar scams than people on Standard Protection, and that more than 1 billion Chrome users had it on in 2025. The footnote explains that the comparison is the average number of safety warnings shown to each group. That is a useful signal, but it is not a count of infections avoided, and the two groups may not behave the same way to begin with.
No browser feature replaces updated software either, which is the point of our explainer on what you lose when a phone stops getting security updates.
Bottom Line
If you have ever walked a relative through a fake virus alert, turning on Enhanced Protection is a cheap safeguard, though it does mean sharing more browsing signals with Google than the default mode. The best defense is still a habit: a real website never needs you to open a terminal or the Run box to prove you are human. Anything asking for that is a scam.
FAQ
What is a ClickFix attack?
It is a scam where a fake error or verification page convinces you to copy a command and run it yourself, usually in PowerShell or a command prompt. Since you launch it manually, it sidesteps the download checks browsers rely on.
Do I need to do anything to get the new Chrome protections?
Google says the features are for Enhanced Protection users and encourages turning that mode on in Chrome and in your Google Account. You can find it in Chrome’s security settings. Google’s post does not give a rollout schedule.
Does Enhanced Protection send my browsing data to Google?
It shares more with Safe Browsing than the default mode does, which is the trade-off for faster protection. For the new features, Google says clipboard content is stripped of personal information and page text is sent only when a site shows high-confidence scam signs, then handled temporarily and not used for training.
Featured image: Photo by Sasun Bughdaryan on Unsplash. Inline photo by Surface on Unsplash. Source: Google’s Chrome security blog, October 20, 2026.
No comments yet. Be the first to share your thoughts below.