Google Upgrades Chrome With Gemini AI to Detect Fake Antivirus and Browser Update Scams

Google has upgraded Chrome’s Enhanced Protection mode with a more powerful Gemini AI model to detect fake antivirus alerts, browser update scams, and other deceptive websites.

Announced on October 20, 2026, the changes also introduce suspicious site warnings and protection against ClickFix attacks that trick users into running malicious commands.

The update expands Google’s earlier work on AI scam detection. Chrome previously used an on-device Gemini model on supported devices to identify tech support scams.

Google has now moved this analysis to a server-side model, extending the feature to all users who enable Enhanced Protection rather than limiting it to compatible hardware.

Chrome Gemini AI Detects Fake Scams

According to Google’s announcement, Gemini examines page content for signs of fraud. It identifies the brand a website claims to represent, assesses the page’s purpose, and produces a score showing how likely it is to be a scam.

Safe Browsing combines these findings with domain reputation and other security signals before reaching a final verdict. This means Gemini does not decide whether to block a website by itself.

Its analysis provides another layer of evidence, helping Chrome assess pages that use convincing security messages or browser branding to pressure visitors into taking unsafe actions.

Google says Chrome sends page text for analysis only when a website shows strong scam indicators. The company says it processes this content temporarily and never logs, retains, or uses it to train its models. These safeguards apply to page content sent for this detection process.

Chrome is also introducing two levels of site warnings for Enhanced Protection users. Suspicious site warnings flag deceptive patterns when Google has lower confidence about the threat. These warnings differ in appearance, wording, colors, and icons from warnings for confirmed dangerous websites.

Known malicious sites will continue to trigger Chrome’s familiar full-page red warning. This approach lets Google warn about more potentially harmful pages while keeping possible risks separate from high-confidence threats.

The update also addresses ClickFix, a technique that asks visitors to copy and run commands to repair a fake problem. Cybersecurity News has previously covered fake Chrome error pages that guide users into executing hidden PowerShell scripts.

These attacks move malware downloads into tools such as PowerShell or cmd.exe, outside Chrome’s normal download checks. Related reporting on DriveSurge’s fake browser updates shows how attackers combine familiar update prompts with command-based infection methods.

Chrome now detects suspicious commands copied during potential ClickFix attempts. It removes personally identifiable information from the copied content before sending it to Safe Browsing. A dangerous verdict triggers a warning, with checks designed to limit disruption to legitimate developer work.

Users must enable Enhanced Protection to receive these features. Google provides instructions in its Chrome Safe Browsing guide. Google also stresses that Chrome will never ask users to repair the browser by copying and running commands from a webpage.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Google Upgrades Chrome With Gemini AI to Detect Fake Antivirus and Browser Update Scams appeared first on Cyber Security News.