Chrome adds AI-driven warnings for suspicious sites alongside dangerous site alerts

Google has enhanced Chrome’s security features to provide more granular warnings about potentially deceptive websites. According to a blog post published on Tuesday, the browser now differentiates between sites deemed dangerous and those rated as suspicious. This update applies to both desktop and mobile versions of Chrome, aiming to protect users from evolving online scams. The changes reflect a shift towards using artificial intelligence to assess site legitimacy before users engage deeply with the content.

Root cause

The new capability relies on Google’s Gemini AI model to analyse various aspects of a website. According to Google, Gemini examines the site’s content, the brand it represents, its intended purpose, and the domain’s reputation. By comparing these factors against known deceptive or misleading sites, the system derives a scam likelihood score. This allows Chrome to identify pages that exhibit patterns commonly associated with phishing, malware, and scams, even if they are not yet classified as outright malicious.

Attack path

Scammers often create sites that mimic legitimate brands or use deceptive patterns to trick users. Previously, Chrome would only warn users about sites known to be dangerous. Now, the browser can identify suspicious sites that share characteristics with known malicious domains. Google states that these suspicious site warnings notify users when a page exhibits deceptive patterns. The system distinguishes these from dangerous sites by using different formats, iconography, colours, and text to guide user decisions.

Affected versions

The new security measures apply to Chrome on both computers and mobile devices. Google outlined these three new measures in a blog post published on Tuesday. The update includes protection against suspicious websites, safeguards against fake antivirus updates, and the ability to thwart ClickFix social engineering attacks. Users will see these enhanced warnings as the browser is updated across its supported platforms.

Mitigation

• Review the new warning indicators in Chrome to understand the difference between suspicious and dangerous alerts.
• Use the "Return to safety" button if a site is flagged as suspicious and you are unsure of its legitimacy.
• Mark sites as safe only if you are certain they are legitimate, to help refine the warning system.
• Keep Chrome updated to ensure access to the latest scam protection features and AI-driven analyses.

What it means for organisations

Teams should assess how these new browser warnings impact their security awareness training. Organisations need to ensure employees understand the distinction between suspicious and dangerous site alerts. IT departments should monitor for any false positives that might disrupt business operations. Security teams should communicate these changes to all users to prevent confusion. This helps maintain a balance between security and productivity.

Background: Security awareness training

Small teams need consistent, low-friction training rather than annual lectures. Focus on phishing simulations and clear reporting protocols. Delegate simulation execution to managed service providers while you manage the response workflow. This approach builds resilience against social engineering without overwhelming limited budgets.

Read the full guide: Security Awareness Training for Small Teams That Actually Works

What to do and how to stay safe: Google

• Train staff to recognise the new visual cues for suspicious versus dangerous sites in Chrome.
• Encourage users to report any sites that seem deceptive but were not flagged by the browser.
• Review internal policies on accessing external websites to align with the new warning levels.
• Monitor for any operational disruptions caused by the increased volume of protective warnings.

Step-by-step guide: Social Engineering Response: Containment and Recovery Steps

General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How does Chrome determine if a site is suspicious?

Chrome uses Gemini AI to analyse the site’s content, brand, intent, domain reputation, and other factors to derive a scam likelihood score.

What is the difference between a suspicious and dangerous site warning?

Dangerous site alerts paint the screen red and strongly recommend leaving, while suspicious site warnings are more subtle and allow users to proceed if they are certain the site is safe.

Does this update apply to mobile devices?

Yes, the new security measures apply to Chrome on both computers and mobile devices.