Chrome Adds ClickFix Warnings to Stop Users From Running Malicious Commands
Google has added a ClickFix scam defense to Chrome's Enhanced Protection: when a user copies a suspicious command from a webpage and prepares to paste it into a terminal, the browser strips personal information from the command, sends it to Safe Browsing for analysis, and warns the user if it is dangerous. The change is part of Google's latest defenses against evolving web scams.
Google states in its official blog that Chrome will never ask users to repair the browser by copying and running commands from a webpage, and that no legitimate website will ask users to paste commands into Win+R, PowerShell, or a terminal. Enhanced Protection users are "ten times safer" than Standard Protection users against phishing, social engineering, notification abuse, and other scams, and more than 1 billion Chrome users had the mode enabled as of 2025.
ClickFix scams trick users into copying a command that appears to fix a problem, but the actually executed command often differs from what is shown on the page. Attackers use built-in operating system utilities such as PowerShell and cmd.exe — so-called Living Off the Land Binaries (LOLBins) — to download and install malware. Because these tools are native to the system and trusted by security software, standard download inspectors cannot catch them. ClickFix scams surged 517% in six months, according to one report.
The new feature only works for users who have Safe Browsing's Enhanced Protection enabled, which must be turned on in Chrome settings. Chrome inspects clipboard activity when a user copies a suspicious command string, removes personally identifiable information (PII), and evaluates it with Safe Browsing in real time; a dangerous verdict triggers a warning, with checks designed to limit disruption to legitimate developer work. Beyond ClickFix, this update upgrades the previously on-device Gemini scam detection to a more powerful server-side model, expanding coverage to fake antivirus and fake browser update scams.
Chrome's Safe Browsing site warnings now come in two tiers: high-confidence malicious sites still get the full-page red "dangerous site" interstitial, while a new "suspicious site" tier covers lower-confidence verdicts and shows a shield icon in the address bar with options to "Mark as safe" or "Back to safety." Google says the separate design lets it safely display more warnings without excessive disruption.