Chrome Deploys Server-Side Gemini to Combat ClickFix Attacks

Google is strengthening Chrome’s Enhanced Protection tier by migrating scam detection to a server-side Gemini model, replacing the previous on-device approach. The AI evaluates page branding, intent, and scam likelihood alongside domain reputation signals. Chrome is also introducing intermediate “suspicious site” warnings for deceptive pages that don’t meet the threshold for full-page alerts, expanding protective coverage without inflating false positives.

The upgrade includes targeted defenses against ClickFix attacks, which manipulate users into executing malicious PowerShell or Command Prompt scripts. When Chrome detects suspicious clipboard content, it strips personal information before sending the payload to Safe Browsing for verification, blocking execution if flagged as dangerous. Privacy protections are built in: the system analyzes only high-confidence scam signals and processes all server-side content ephemerally, never logging, storing, or using it for model training. Enhanced Protection users should see roughly tenfold improvement in defenses against phishing, social engineering, and notification abuse compared to standard protection.