Overview
- Google rolled these protections into Chrome 155 and is enabling HTTPS-first behavior by default for desktop and Android users to block insecure HTTP connections before they form.
- The HTTPS-first setting asks users for permission on first visits to HTTP sites and skips warnings for private hostnames and local IP addresses to avoid breaking intranet and router pages.
- Safe Browsing’s extended protection now calls a server-side Gemini model to analyze suspicious pages and combines that AI output with domain reputation and other signals.
- Chrome introduces two warning levels in the extended protection flow: a small popup for pages that look suspicious and the existing red interstitial for pages judged dangerous.
- ClickFix detection analyses copied commands after removing personal data and will only upload clipboard or page content when clear fraud indicators appear, with Google saying the data is processed briefly and not logged or used to train models.