Key points
- Chrome 152 adds a new warning tier for sites showing signs of deception but not yet confirmed as dangerous.
- These alerts appear as bypassable pop-ups, distinct from the full-page red warnings reserved for high-risk threats.
- The feature requires users to have Safe Browsing Enhanced Protection mode enabled to receive the lower-confidence alerts.
Google has introduced a new layer of browser warnings that flag websites showing signs of deception before they are officially classified as dangerous. This change allows Chrome users to see potential threats earlier in the browsing process, providing an additional safety net against sophisticated scams that may not immediately trigger traditional security blocks.
How it unfolded
- On August 25, 2026, Google released Chrome 152, which included documentation for the new suspicious-site warning category.
- On October 20, 2026, Google formally announced the feature, detailing how it distinguishes between lower-confidence suspicious sites and high-risk dangerous sites.
- The update shifts scam detection from an on-device model to a server-side system that analyzes page content for deceptive behavior.
Who is affected
Users who have enabled Safe Browsing’s optional Enhanced Protection mode will encounter these new alerts. According to TechRepublic, this group includes individuals who opt for stricter security settings than the default browser configuration provides. Employees in corporate environments are particularly relevant, as the ability to bypass these pop-ups means that human judgment plays a larger role in workplace security outcomes.
What happens next
The new alerts appear as bypassable pop-ups, allowing users to proceed if they choose to dismiss the warning. This differs significantly from Chrome’s existing full-page red danger warnings, which block access to sites Google identifies as high-risk threats. Google states that page text is analyzed only when strong scam indicators appear and is not retained or used to train models, addressing privacy concerns about server-side processing.
The background in plain language
Browser security often relies on blacklists of known bad sites. However, new scams appear faster than lists can update. Enhanced protection uses behavioral analysis to spot deception in real time. Teams usually configure browsers to balance security with usability. Check whether your organization’s policy allows bypassing warnings. Understanding the difference between a confirmed threat and a suspicious signal helps users make safer choices without being blocked from legitimate services.
What to do and how to stay safe: Google
- Verify that Safe Browsing Enhanced Protection is enabled in your browser settings to receive these early warnings.
- Train staff to treat bypassable pop-ups as serious alerts, requiring verification of the URL before entering any credentials.
- Monitor for ClickFix scams that disguise malicious commands as troubleshooting instructions, as these are specifically targeted by the new detection.
- Review browser extension permissions regularly, as fake extensions can mimic trusted services to bypass security controls.
Step-by-step guide: Mobile Device Security for Small Business: Control Without Cost
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Do I need to change any settings to see these new warnings?
Yes, you must have Safe Browsing’s optional Enhanced Protection mode enabled to receive the new suspicious-site alerts.
Can I ignore these new pop-up warnings and continue browsing?
Yes, the new suspicious-site alerts are bypassable, allowing users to proceed after dismissing the warning, unlike full-page danger blocks.
Does Google store the text from pages it analyzes for scams?
No, Google states that page text is analyzed only when strong indicators appear and is not retained or used to train models.
