Chrome will now warn you when you copy a booby-trapped 'fix' command

What Google changed in Chrome

Google has added new protections to Chrome aimed at a scam type called ClickFix. As CyberInsider reported, the changes were laid out by Chrome's Jasika Bawa in an announcement covering protections rolled out during 2026. Three features are involved, and all of them belong to Enhanced Protection, an optional mode within Chrome's Safe Browsing system.

The three pieces are a warning when you copy a suspicious command, a stronger Gemini-based scam detector, and a new gentler warning for sites that look shady but have not been proven dangerous. If you leave Chrome on its default settings, you do not get these.

How a ClickFix scam works

ClickFix attacks start with a web page that claims something is wrong with your computer or browser. The page then tells you to copy a command and run it yourself, usually as a way to fix the supposed problem. The catch is that the text placed on your clipboard (the temporary holding spot for copy and paste) can differ from what the page shows you.

These attacks often lean on genuine Windows tools such as PowerShell and cmd.exe, which are text-based control windows for giving the computer instructions. Used this way, they download and start malware. Because the activity happens in a terminal and not in the browser, Chrome's usual checks on downloaded files never see it.

The new check on copied commands

For Enhanced Protection users, Chrome now notices when a suspicious command is copied. It removes personally identifiable information from the copied text and sends it to Safe Browsing for analysis. If the verdict is dangerous, Chrome shows a warning before the command gets used.

Google says it tuned the system for precision, so it interrupts people as little as possible during legitimate activity. Developers who copy commands all day are the example it gives. CyberInsider also notes that the Opera browser and the uBlock Origin extension already had similar protections.

Gemini moves to Google's servers

In 2025, Chrome introduced scam detection that ran Gemini, Google's AI model, directly on your device. That version focused on tech support scams and needed supported hardware. Google is replacing it with a more powerful model that runs on its own servers.

The upside is reach. The protection now extends to all Enhanced Protection users and covers more threats, including fake antivirus alerts and fraudulent browser updates. Gemini looks at page content for signs such as which brand is being imitated, what the page is trying to get you to do, and how likely it is to be a scam. Safe Browsing then weighs that against domain reputation and other signals.

The tradeoff is privacy. Selected page text now leaves your device. Google says this happens only after a site shows strong scam indicators, and that the content is handled temporarily, without being logged, kept, or used to train models.

A softer warning, and a number to read carefully

Chrome is also adding a separate warning for sites that show deceptive patterns but where the evidence is weaker. It looks different from the familiar full-page red warning, which stays reserved for sites classified as dangerous.

Google says Enhanced Protection users are now "ten times safer" than people on Standard Protection. The footnote matters, though: the comparison measures the average number of safety warnings shown. It does not measure how many scams or infections were actually prevented. That makes it a useful hint, not proof that the protection works that well.

What to do with this

If you want these features, you can turn on Enhanced Protection in Chrome's Safe Browsing settings, under Privacy and security. Weigh the benefits against the fact that, in some cases, page text goes to Google for analysis.

Whatever setting you pick, one habit covers you everywhere. If a web page tells you to paste a command into PowerShell, Command Prompt, or any terminal to fix your browser, treat that as a red flag and close the page.