Google is updating Chrome's Enhanced Protection mode with a two-stage warning system for websites. Both Help Net Security and The Verge report that sites judged "suspicious" — similar to known phishing or scam pages but with lower confidence — now trigger a pop-up with a darkened page and a "Mark as safe" option, while "dangerous" sites keep Chrome's full-screen red warning. The Verge notes the design mirrors the two-stage file download warnings Chrome introduced in 2024.
The two outlets also agree that Google has moved its Gemini-powered scam detection from an on-device model to a server-side model for Enhanced Protection users. According to Help Net Security, the model now checks for fake antivirus and browser update scams in addition to tech support scams, analyzing page content, brand, intent, and scam likelihood. Page text is sent only when high-confidence scam indicators are present, and Google says it is not logged, retained, or used for training.
Help Net Security adds a detail The Verge does not cover: Chrome now targets ClickFix scams, where pages trick users into copying a malicious command to "fix" a fake problem. When Enhanced Protection users copy a suspicious command, Chrome strips personally identifiable information from the clipboard payload and sends it to Safe Browsing for analysis, warning the user if the command is dangerous. The Verge, meanwhile, emphasizes the user-facing distinction between the two warning levels, including the "Mark as safe" option for mistaken flags.