Chrome's Enhanced protection detects suspicious commands copied as part of scams, sends them to Google after processing them to remove personally identifiable information, and warns users if they are dangerous. Gemini's analysis of scam pages has also moved to the server side.
Key points
On October 20, 2026, local time, Google expanded Chrome's scam protections. Checks on copied commands apply to users who have enabled "Enhanced protection" in Chrome's Safe Browsing settings.
When Chrome detects a suspicious command being copied, it processes the content to remove information that could identify individuals and sends it to Google. If the command is judged dangerous, Chrome displays a warning.
Copying a command before executing it is now covered by these checks. Google says it designed the feature with an emphasis on precision to avoid disrupting legitimate command-line work by developers.
ClickFix is a scam technique that tricks users into copying and executing malicious commands themselves.
ClickFix prompts users to copy and execute commands under the pretext of fixing a nonexistent problem or completing a fake identity check. The command actually copied can differ from the text visible on the page.
Legitimate operating system programs, such as Windows PowerShell or cmd.exe, are abused. The command runs outside the browser. It can lead to malware being downloaded or launched without passing through the checks Chrome normally performs on file downloads.
In May 2026, researchers investigated ClickFix attacks (in Japanese) in which websites using the Ghost CMS publishing platform were compromised and fake human-verification pages directed visitors to execute commands.
Chrome's new detection targets the copy operation that occurs between a website's instructions and execution of an operating system command. Google cautions that Chrome never asks users to perform such actions to fix problems.
Google's announcement says the check runs when an Enhanced protection user copies a suspicious command. It describes the detection and transmission of suspicious commands, rather than comprehensive collection of every copy operation or clipboard history.
Copied content is sent to a server after processing to remove personally identifiable information. In other words, deciding whether to show a warning involves sending the copied content outside the device. In this announcement, Google does not specify exactly what information it removes as personally identifiable or how long the transmitted commands are retained.
By contrast, Google says page text sent for Gemini's scam assessment is processed ephemerally, without logging, retention, or use in model training. This is an explanation about page text; it does not explicitly state whether the same retention policy applies to data transmitted from the clipboard.
In 2025, Google announced a system that ran Gemini Nano on supported devices in Chrome 137 to look for signs of fake technical support pages. It has now moved to a larger Gemini model running on servers.
The new model analyzes factors such as the company or service a page claims to represent, its purpose, and the likelihood that it is a scam. Joho no Todai confirmed that Safe Browsing makes the final decision, combining Gemini's analysis with factors such as the site's URL reputation.
This expands detection beyond fake technical support to scams impersonating antivirus software or browser updates. Google says the page text used for scam detection is sent to its servers only when a site shows strong signs of a scam.
Chrome is also changing its site warnings. It will show a new warning for sites suspected of being dangerous based on deceptive content or other signals. Sites classified as malicious with high confidence will continue to trigger a full-page red warning.
By distinguishing warnings about suspicious sites from those about dangerous sites, Google aims to flag more sites while conveying different levels of risk. These differentiated warnings also apply to Enhanced protection users.
Google's Japanese help page for desktop Chrome lists Safe Browsing's "Standard protection" as the default. Receiving warnings about suspicious copied commands requires enabling Enhanced protection.
Originally published on Joho no Todai. The Japanese original is here.