Google announced on Tuesday, October 20th, an update to Google Chrome that adds a new layer of warning for potentially suspicious pages. Unlike the traditional red screen reserved for sites classified as dangerous, the browser will initially display a pop-up alerting that the page 'does not seem right.'
This change will be available to users who use the Advanced Protection mode of Safe Browsing. Furthermore, Google will integrate Gemini models, run in the cloud, to analyze potential fraud and offer specific protection against ClickFix attacks.
These features are part of the Safe Browsing Advanced Protection mode and can be activated in Chrome's privacy and security settings. By enabling this option, the browser begins sharing data with Google to verify extensions, downloads, and visited pages.
This new categorization follows the methodology Google applied to file downloads two years ago. Pages that show signs of deceptive behavior but have not yet reached malicious page status will now receive the label of a suspicious site. In these cases, Chrome will darken the page and display a window with the message 'This site does not seem right,' giving the user the option to proceed or return. Dangerous sites, however, will continue to be blocked via a full red screen.
Jasika Bawa, Chrome Product Manager, explained that this modification allows distinguishing between pages that the system has not yet evaluated with the same degree of confidence. Thus, Google can increase alerts without completely preventing browsing in all considered dubious scenarios.
Chrome is also expanding the use of Gemini to identify scams during browsing. Last year, Google launched a model running locally on compatible devices to detect pages imitating technical support services. Now, part of this analysis will be conducted by the company's servers, allowing the detection of other forms of fraud, such as pages pretending to be antivirus alerts or fake browser updates.
The system analyzes various factors, including the brand the page claims to represent, the content presented, and any risk signals, cross-referencing this information with data on the address's reputation. Google assures that this processing is temporary, and analyzed texts are not retained in logs nor used in the training of artificial intelligence models.
Another notable improvement is the ability to identify commands used in attacks known as ClickFix. In these attacks, the user is induced to copy instructions for tools like PowerShell or the Windows Command Prompt, where malware can be downloaded. Google reported that the browser removes personal information from the clipboard before consulting Safe Browsing and, if a risk is detected, displays an alert before the command is executed.