Chrome introduces two-tier warnings to distinguish suspicious from dangerous sites

Key points

• The new feature is available only when Chrome’s Enhanced Protection mode is enabled.
• Suspicious site warnings appear as a pop-up with a darkened background, allowing users to mark the site as safe if they are confident it is legitimate.
• Dangerous site warnings remain a full-screen red interstitial that blocks access entirely, indicating a high confidence verdict of malicious intent.
• Google expanded its Gemini-powered scam detection to all Enhanced Protection users, moving from on-device to server-side analysis for broader threat coverage.
• The update includes new defenses against 'ClickFix' social engineering attacks, where users are tricked into copying and executing malicious commands in their terminal.

Background

This development follows a 2024 update where Google introduced a similar two-tier warning system for file downloads. In 2025, Google reported that over one billion Chrome users had enabled Enhanced Protection. The current update builds on these previous security enhancements, aiming to make Enhanced Protection users ten times safer from phishing and social engineering compared to Standard Protection users.

How outlets are covering it

The Verge highlights the user-facing distinction between the two warning types, emphasizing the visual differences and the ability for users to override 'suspicious' warnings. Google’s official blog post focuses on the technical improvements, detailing the shift to server-side Gemini models for scam detection and the new protection against ClickFix attacks. While The Verge notes the potential for false positives in the 'suspicious' category, Google frames this as a necessary trade-off to expand the volume of protective warnings without compromising the integrity of high-confidence 'dangerous' blocks.

Why it matters

This update improves the balance between security and usability for Chrome users. By differentiating between low-confidence and high-confidence threats, Google allows users to navigate potentially risky sites with more agency while maintaining strict barriers against confirmed malicious content. The integration of Gemini AI also signals a broader trend in using artificial intelligence to enhance real-time threat detection in web browsers.

What to watch

Users should ensure their Chrome browsers are updated and that Enhanced Protection mode is enabled to receive these new warnings. Google may continue to refine the Gemini-based detection models and expand the range of social engineering tactics covered by the ClickFix protection. Users are advised to remain cautious of any warning that asks them to manually execute commands to 'fix' browser issues, as this is a common scam tactic.