Google Adds Chrome Protection Against ClickFix
Chrome in Enhanced Protection mode can detect the copying of suspicious commands used in ClickFix attacks and display a warning after analysis through Safe Browsing.
Chrome protection against ClickFix is a new feature Google announced on October 20, 2026, for users of Safe Browsing Enhanced Protection. The browser is designed to detect the copying of suspicious commands typical of ClickFix social engineering attacks, send them to Safe Browsing for evaluation, and display a warning if they receive a dangerous verdict.
Chrome protection against ClickFix when using the clipboard
ClickFix attacks rely on persuading users to paste and run a command themselves. Attackers often use legitimate system tools, such as PowerShell or cmd.exe, to download malware.
This manual step can bypass standard mechanisms focused on risky file downloads. ClickFix therefore moves the decisive stage of the infection from the browser to a terminal or system dialog.
Google said Chrome removes personal data from the clipboard content when it detects a possible ClickFix script. It then sends it to Safe Browsing for analysis. If the service determines that the command is dangerous, the browser displays a warning to the user.
The feature requires Enhanced Protection
The protection requires Enhanced Protection to be enabled in Safe Browsing. This is an optional advanced browsing protection setting that Google also uses for other security checks.
The new feature is part of broader changes to Safe Browsing. Google also mentioned warnings about suspicious websites and server-side analysis of fraudulent pages using the Gemini model.
A warning does not block every attack
Google has not published data on the ClickFix attack detection rate or the number of attempts the feature has already blocked. It also has not disclosed an exact rollout schedule by Chrome version, platform, or region.
The mechanism responds to a suspicious command after evaluating it and displays a warning. This does not mean it will stop every case: users can bypass the warning, and the protection will not apply when the command does not reach the clipboard through Chrome.
Users should therefore continue to avoid running commands that a website or an unknown person tells them to paste into PowerShell, the command prompt, or another system tool.
What comes next
It remains necessary to monitor which Chrome versions and platforms will support the protection. Google’s potential data on detection effectiveness will also be important, as will the evolution of techniques used by attackers who may move commands to other browsers, applications, or delivery channels.
Sources
- Google Security Blog – Officially confirms Chrome’s protection against copying suspicious ClickFix commands, the Enhanced Protection requirement, and the Safe Browsing analysis process.
- SecurityWeek – Independently summarizes the new ClickFix protection and other Safe Browsing security changes.
- The Hacker News – Corroborates the purpose of protection against social engineering in which victims run commands on their systems.
Verified and updated: October 21, 2026 22:54
