Chrome’s Server-Side Gemini AI Expands Scam Detection to All Enhanced Protection Users

Google announced on October 20, 2026, that Chrome’s Enhanced Protection mode now utilizes a server-side Gemini AI model to detect deceptive websites. This update expands scam defenses to all users who enable the feature, moving beyond the earlier on-device integration that was limited to supported hardware.

The new server-side analysis allows Chrome to assess a wider range of threats, including fake antivirus alerts and fraudulent browser updates. According to GBHackers, the model analyzes page content to identify brands and assess intent, generating a scam likelihood score. Safe Browsing combines this with domain reputation data to issue final verdicts.

Context and Background

This development builds on the on-device Gemini integration introduced in 2025, which previously identified technical support scams on compatible devices. By shifting the processing to a more powerful server-side model, Google can broaden device coverage and evaluate complex deception tactics that mimic legitimate security messages.

As Threat Times reported on October 21, 2026, Google’s browser now uses Gemini AI to score scam likelihood, offering distinct warnings for suspicious pages while protecting against fake antivirus and ClickFix attacks. The current update refines this capability by ensuring all Enhanced Protection users benefit from the deeper inspection, regardless of their device’s computational limits.

Who Is Affected

The changes apply specifically to Chrome users who have enabled Safe Browsing’s Enhanced Protection mode. These users will now see separate warning categories for suspicious and dangerous websites. Suspicious warnings cover lower-confidence findings involving deceptive patterns, while dangerous verdicts reserve the familiar full-page red warning for known malicious pages.

Chrome also introduces new protections against ClickFix attacks, which trick users into copying and executing commands that falsely claim to fix problems. These commands often use legitimate utilities like PowerShell or cmd.exe to bypass browser download protections. Chrome now detects potentially malicious commands copied during suspected ClickFix activity.

What should you do?

Users should verify that Enhanced Protection is enabled in their Chrome settings to access these new AI-driven defenses. Security teams should monitor for reports of ClickFix attempts, as attackers may still try to bypass detection by using

Background: Fake antivirus software

Fake antivirus software mimics legitimate security interfaces to display false threats. Look for urgent pop-ups, pressure to buy, and missing digital signatures. Immediate isolation prevents data theft. Use offline scanners to remove the rogue agent, as it will block standard uninstallation methods. Verify system integrity afterward.

Read the full guide: Fake Antivirus Warning Signs: How to Spot and Remove Rogue Security Software

What to do and how to stay safe

• Hardware-backed key storage prevents attackers from extracting credentials even if they gain physical access to the device.
• Mobile device management enforces consistent security policies across diverse operating systems and hardware configurations.
• Application sandboxing limits the damage a compromised app can cause by restricting its access to other data and system resources.

Mobile device security requires a layered approach combining hardware, software, and policy controls. Enable encryption, use strong passcodes, and keep your operating system updated to protect your data.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.