Chrome Adds Scam Warnings and Makes HTTPS-First Warnings Default

ZDNet reported that Chrome will now flag sites deemed suspicious, not only sites known to be malicious. The warning may say a site does not seem right because it resembles sites linked to phishing, malware and scams; users can open a Learn More link, close the page, click Return to safety or mark the site as safe. Google said it compares a site with deceptive or misleading sites and uses Gemini to analyze page content, the brand represented, site intent and domain reputation to produce a scam-likelihood score. The suspicious-site alert is presented differently from the red dangerous-site warning, which strongly advises leaving the page; the suspicious alert is more subtle and lets users continue if they are certain the site is legitimate. Google said in a blog post that the warnings differ by format, iconography, color and text so users can make a choice based on context, and that this lets Chrome expand its protective warnings.

Chrome’s AI-powered scam detection, previously used against tech support scams, now covers a wider range of scams including fake antivirus and phony browser updates, ZDNet reported. Google uses a server-side Gemini model to analyze page content, domain reputation and other signals. Google said the amount of data sent to the back-end server is minimized and shared only when a site triggers high levels of scam signals; page content sent from a computer or mobile device is not logged, remembered or used to train the AI.

Chrome will also detect ClickFix attacks, in which a site tricks users into copying and running malicious commands themselves, often under the pretext of fixing a nonexistent technical problem, according to ZDNet. Because the user performs the steps, existing defenses have not caught the attack. In the new update, Chrome detects when a user is tricked into copying suspicious commands, clears personal data from the clipboard before it can be pasted, analyzes the copied data and shows a warning if the activity is dangerous.

Android Authority reported that Google is enabling Chrome’s “Always Use Secure Connections” setting for all users by default. The optional toggle, introduced in 2022, warns users before they connect to insecure HTTP websites and gives them a chance to back out; Chrome will not repeatedly warn about approved HTTP sites, and Google says most users are unlikely to encounter these warnings. The setting was enabled earlier this year for users in Chrome’s Enhanced Protection mode and is now a standard part of browsing, the report said. Google said last year it would prioritize secure HTTPS connections and warn about sites still using HTTP, Android Authority added.

The new scam defenses require Chrome’s Enhanced Protection mode in Safe Browsing, ZDNet reported. On desktop or mobile, users can open Settings, select Privacy and security and choose Security on desktop or Safe Browsing on mobile, then select Enhanced Protection. Users can also turn on Enhanced Safe Browsing for their Google account through Security & sign-in, the report said.