Loading story…
Google is expanding Chrome’s Enhanced Protection with warnings for malicious commands used in ClickFix scams, broader Gemini-powered scam detection, and a new distinction between suspicious and dangerous websites. ClickFix attacks persuade users to copy and run commands under the guise of fixing a problem, moving malware delivery into terminals to bypass browser download safeguards. Chrome checks suspicious copied commands through Safe Browsing after removing personally identifiable information from the submitted clipboard payload and warns users when a command is judged dangerous.
Gemini-powered scam detection is moving from an on-device model to a server-side model and expanding beyond tech support scams to fake antivirus and browser update scams. Safe Browsing combines page analysis with domain reputation and other security signals; Google says submitted page content is not logged, retained, or used for model training. The new suspicious-site alerts, which require Enhanced Protection, display a pop-up over a dimmed page for lower-confidence findings and offer a “Mark as safe” option. High-confidence dangerous-site findings instead trigger a prominent red warning page. Organizations should review Enhanced Protection deployment and reinforce that users must not run commands supplied by websites claiming to repair browser or security problems.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
Google announced that Chrome now requests approval before connecting to unencrypted HTTP sites by default for all users, expanding an earlier rollout to Enhanced Protection users. Local IP addresses and single-label hostnames are exempt by default; approved sites trigger another warning only after at least two weeks without a visit.
Chrome introduced separate classifications for suspicious and dangerous downloads, preceding a similar distinction in website warnings.
Google introduced Enhanced Protection for Chrome’s Safe Browsing feature to address online scams and social engineering.
Google is updating Chrome Enhanced Protection to inspect suspicious commands copied from deceptive pages and warn when Safe Browsing determines they are dangerous. Chrome removes personally identifiable information from the clipboard payload before submission, targeting scams that bypass browser download safeguards by persuading users to execute commands in a terminal.
Google moved Chrome’s Gemini-powered scam detection from an on-device model to a server-side model for Enhanced Protection users, adding fake antivirus and browser update scams to existing tech support scam detection. Safe Browsing combines Gemini’s page analysis with domain reputation and other signals; Google says submitted page content is not logged, retained, or used for model training.
Chrome introduced pop-up warnings over dimmed webpages for low-confidence suspicious-site verdicts, with a “Mark as safe” option for potential false positives. These alerts require Enhanced Protection and are distinct from the full-page red warnings for high-confidence dangerous sites.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
8 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcezdnet.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcepunto-informatico.it
Open sourcepunto-informatico.it
Open sourcehelpnetsecurity.com
Open sourceblog.google
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google is testing deeper **Gemini** integration in Chrome via a new internal feature called **“Skills,”** which appears to let users define named, instruction-based automations that Gemini can execute inside the browser. The feature is surfaced through a new `chrome://skills` page and aligns with Google’s stated direction of turning Gemini into a more agent-like assistant capable of acting across tabs and, over time, integrating more tightly with Google services. Separately, Google has added user controls to manage the **on-device GenAI model** used by Chrome’s *Enhanced Protection* (Safe Browsing) capabilities, which were previously upgraded with AI for “real-time” detection of dangerous sites, downloads, and potentially malicious extensions. In Chrome Canary, users can disable *On-device GenAI* under **Chrome → Settings → System**, which also enables deletion of the local model; Google indicated the local model may support additional security and browser features beyond scam detection as it rolls out more broadly.
May 6, 2026
Google has acknowledged the significant risk of prompt injection attacks targeting its Gemini-powered Chrome browsing agent, which can be manipulated to perform unauthorized actions such as initiating financial transactions or exfiltrating sensitive data. In response, Google has introduced a second AI model, termed the 'user alignment critic,' designed to independently vet the agent's proposed actions before execution. This model operates in isolation from untrusted web content, providing an additional layer of defense against both goal hijacking and data leakage. The move comes as prompt injection has been identified as a leading vulnerability in AI systems, with industry bodies like OWASP and the UK's National Cyber Security Centre highlighting its prevalence and difficulty to mitigate due to the structural limitations of large language models. The Gemini-powered browsing agent, currently in preview, is capable of navigating websites, clicking buttons, and filling forms while users are logged into sensitive accounts, increasing the potential impact of successful attacks. Security experts and analysts have emphasized the need for robust safeguards, as malicious instructions can be hidden in web pages, iframes, or user-generated content. Google's dual-model approach aims to address these concerns by ensuring that any action not aligned with the user's intent is blocked, thereby reducing the risk of exploitation through prompt injection. The development reflects a broader industry trend of reassessing the security of AI-driven browsers and the need for advanced countermeasures to protect users and organizations from emerging threats.
Dec 10, 2025
Google said expanded use of AI across Chrome’s security workflow helped it identify and remediate **1,072 security bugs** in Chrome 149 and Chrome 150, a total that exceeded the number fixed across the prior 23 Chrome milestones combined. The company said large language models and Gemini-based systems are now being used for vulnerability discovery, reproduction, severity assessment, bug routing, patch generation, test creation, code review, and update delivery. Google also said AI-assisted analysis uncovered a **sandbox escape** flaw that had existed for more than 13 years and could have allowed a compromised renderer to access local files. Google attributed the spike in fixes to improved detection rather than a decline in Chrome security, describing AI as a way to scale vulnerability hunting and preemptive remediation across a massive codebase. To shorten the window between patch creation and user protection, the company is piloting twice-weekly security releases and developing dynamic patching and less disruptive automatic restart mechanisms. Google also said it is expanding memory-safety efforts such as **MiraclePtr**, moving new components to **Rust**, scanning code changes with AI before merge, and improving third-party component update pipelines.
Jul 15, 2025