Chrome uses server-side Gemini to flag fake antivirus scams

Enhanced Protection adds scam scoring, separate suspicious warnings, and clipboard checks for ClickFix commands.

Google said on October 20, 2026, that Chrome Safe Browsing Enhanced Protection now uses a server-side Gemini model to score fake antivirus alerts, fraudulent browser-update pages, and other deceptive sites. Gemini reads page text to identify brand and intent; Safe Browsing combines that score with domain reputation and other signals. Analysis is limited to pages that already show high-confidence scam indicators, and Google says that text is not logged, retained, or used for training. Chrome also adds a lower-confidence suspicious warning and checks clipboard commands copied during suspected ClickFix activity after stripping personal data.

Unconfirmed: Google’s “ten times safer” claim compares average warnings across modes, not a measured drop in successful compromises.