Chrome Adds Lower-Confidence Suspicious Site Warnings, Backed by Server-Side Gemini Checks

Ras Al Khaimah, United Arab Emirates, 25 October 2026.

Google has added a second, lower-confidence tier of site warnings to Chrome. In a Chrome Security post published on 20 October 2026, Group Product Manager Jasika Bawa said Safe Browsing's Enhanced Protection mode now splits page warnings into "suspicious" and "dangerous" sites, and that a server-side Gemini model now reviews pages for scam signals for every Enhanced Protection user. Google said the new format lets it "safely expand our coverage to display a higher volume of protective warnings".

The post is written for Chrome users, and it does not mention Google Search, Search Console or how site owners will be told about the new warnings. For SEO teams the practical question is what happens when a legitimate page lands in the new tier. We read the post alongside Google's current Search Console and Search Central documentation to map out what is known and what is not.

What changed

• Two tiers of site warnings. For users with Enhanced Protection turned on, Chrome now separates suspicious sites (a lower-confidence verdict with a possible risk of harm) from dangerous sites (a high-confidence verdict with a high risk of harm). Dangerous sites keep the familiar full-page red interstitial. Suspicious sites get a different format, icon, colour and wording.
• More warnings overall. Google said the distinct design is what allows it to show a higher volume of warnings. That suggests the new tier will reach pages that did not meet the bar for a red screen, though Google did not describe the thresholds.
• Gemini moves server side. Last year Chrome used on-device Gemini to spot tech support scams on supported devices. Google has now switched to a larger server-side Gemini model, extended it to all Enhanced Protection users, and widened its scope to fake antivirus and fake browser update scams. The model assesses the brand a page represents, the page's intent and a scam likelihood score, and Safe Browsing combines that with domain reputation and other signals to reach a verdict.
• ClickFix detection. Chrome now detects when an Enhanced Protection user copies a suspicious command of the kind used in "ClickFix" scams, strips personal data from the clipboard content, and sends it to Safe Browsing. A warning appears if the verdict is dangerous.

Google said Enhanced Protection users are ten times safer from phishing and scams than users of Standard Protection. A footnote in the post explains that this figure compares the average number of safety warnings shown to each group, so it measures warning volume rather than harm prevented. The post also repeats Google's 2025 figure that more than 1 billion Chrome users have Enhanced Protection enabled.

The same pattern Chrome used for downloads in 2024

The new site tiers copy a structure Chrome introduced for file downloads. In a Google Security Blog post on 24 July 2024, Chrome described a two-tier download warning taxonomy built on Safe Browsing's AI-powered malware verdicts. Placing the two announcements side by side shows how closely the site warnings follow the earlier model.

Warning	Downloads (July 2024)	Sites (October 2026)
Lower tier	Suspicious files: lower confidence verdict, unknown risk of user harm	Suspicious sites: lower confidence verdict, possible risk of user harm
Upper tier	Dangerous files: high confidence verdict, high risk of user harm	Dangerous sites: high confidence verdict, high risk of user harm
Who sees it	Chrome users downloading files	Chrome users with Enhanced Protection turned on
Main source of verdict	Safe Browsing AI-powered malware verdicts	Safe Browsing signals, now including a server-side Gemini scam assessment

Where site owners would see it: Search Console already has a warning tier

Google's Security issues report help page says pages affected by a security issue can show a warning label in search results or an interstitial warning page in the browser. It also tells site owners to treat the report as "the source of truth", because Safe Browsing shows warnings based on browsing context and they may not be reproducible.

We counted every issue type listed on that help page and the severity icon Google attaches to each. Of 12 issue types, 9 are marked as errors and 3 as warnings. One of the three warnings is "Suspected deceptive pages", which Google describes as a site flagged for potentially containing deceptive content, separate from the error-level "Deceptive pages" issue.

Search Console security issue	Severity	Area
Hacked: Malware	Error	Hacked content
Hacked: Code injection	Error	Hacked content
Hacked: Content injection	Error	Hacked content
Hacked: URL injection	Error	Hacked content
Deceptive pages	Error	Social engineering
Deceptive embedded resources	Error	Social engineering
Harmful downloads	Error	Malware and unwanted software
Links to harmful downloads	Error	Malware and unwanted software
Unclear mobile billing	Error	Mobile billing
Possible phishing detected on user login	Warning	Social engineering
Suspected deceptive pages	Warning	Social engineering
Uncommon downloads	Warning	Malware and unwanted software

Google has not said whether Chrome's new suspicious site warnings will surface in Search Console as "Suspected deceptive pages", as a new issue type, or not at all. That link is our reading of the two documents, not something Google has confirmed. What the help page does state is that every issue type, including the warning-level ones, can be cleared with a review request, and that a review can take from a few days to a few weeks.

Which legitimate sites are most exposed

The Gemini model's new targets, fake antivirus and fake browser update scams, match examples Google already gives in its social engineering documentation. That page shows deceptive popups claiming a browser needs updating, and it makes three points that matter to otherwise honest sites:

• Embedded content counts against the host page. Google says social engineering in ads or other embedded resources is a policy violation for the page that carries it, even when the ad is served by a third party or appears through pop-ups and redirects.
• Hacked sites are a common source. Google notes that attackers take over innocent sites to host or distribute deceptive content, often by adding pages the owner never created.
• Unlabelled third-party services can be flagged. A site run on behalf of another organisation, such as a donation platform for a charity, must say so clearly or risk being treated as social engineering.

Ad-supported publishers with loosely controlled programmatic demand, and sites still recovering from the PHP flaws covered in our report on Google's 503 advice during patching, sit closest to that line. A lower-confidence tier means a page does not need to be confirmed malicious to put a warning in front of some visitors.

What SEO teams should do

1. Check the Security issues report weekly. Google calls it the source of truth. Add it to the same routine as the Page indexing report, and make sure the right people get Search Console email alerts.
2. Look up your domains in Google's Safe Browsing site status tool in the Transparency Report, including subdomains and campaign microsites.
3. Audit ad and widget sources. Ask ad partners how they block "update your browser" and fake antivirus creatives, and test pages on mobile where pop-unders are common.
4. Label third-party flows. Checkout, donation and booking pages operated by a vendor should clearly name the brand they act for.
5. Use the right channel for a false positive. Google's help page points site owners to the Safe Browsing error report for misclassified pages, and to a review request in Search Console once real issues are fixed.
6. Watch traffic by browser. Because only Enhanced Protection users see the new tier, a sudden drop in Chrome visits with stable rankings and stable visits from other browsers is a signal worth checking against the report. Google's hacked sites guide covers clean-up if you find injected content.

The change follows Chrome's move to warn all users before insecure HTTP connections, which we covered in our report on Chrome's HTTP warnings. Together the two updates widen the set of browser warnings a visitor can meet before a page loads, independent of where it ranks. Programmatic ad quality has also been under pressure from low-quality sites, as DoubleVerify's figures on AI slop sites showed.

Methodology

On 25 October 2026 we fetched Google's Security issues report help page in English and extracted every issue type from the page's expandable sections, recording whether Google marks each with its red error icon or amber warning icon. We counted 12 issue types: 9 errors and 3 warnings. The grouping into areas follows the three categories Google lists on the same page (hacked content, malware and unwanted software, social engineering), with unclear mobile billing shown separately. We compared the tier definitions word for word against Google's July 2024 downloads post and the 20 October 2026 Chrome Security post.

Conclusion

Chrome's suspicious site tier is a user protection feature, but it lowers the bar at which a page can show a warning, and it adds a Gemini model to the scoring. Google has not yet said how site owners will be notified about the new tier or how it relates to Search Console's existing warning-level issues. Until it does, the safest course is to treat the Security issues report, the Safe Browsing site status tool and browser-level traffic as one monitoring set, and to clean up any embedded content that looks like a fake system message.

Questions and answers

What is Chrome's new suspicious site warning?

It is a lower tier of Safe Browsing warning for Chrome users with Enhanced Protection turned on. Google describes suspicious sites as a lower confidence verdict with a possible risk of user harm, shown in a different format from the full-page red warning used for dangerous sites.

Who sees the suspicious site warnings?

Google's 20 October 2026 post says the two-tier site warnings apply when Enhanced Protection mode of Safe Browsing is enabled in Chrome. Google said in 2025 that more than 1 billion Chrome users had it enabled.

Will site owners see the new warnings in Search Console?

Google has not said. Search Console's Security issues report already lists 3 warning-level issue types, including Suspected deceptive pages, but Google has not confirmed how the new Chrome tier maps to the report.

How do I fix a Safe Browsing warning on my site?

Google's help page says to fix the issues listed in the Security issues report and then request a review, which can take from a few days to a few weeks. Pages you believe were misclassified can be reported through Safe Browsing's error report form.

###