Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections

Summary

Google has added new Chrome protections against scams and social engineering, including two-level site warnings, server-side Gemini analysis for Enhanced Protection users, and detection of ClickFix commands copied to the clipboard. Chrome also now asks users for approval before connecting to a site over unencrypted HTTP, a setting Google has turned on by default for everyone.

Mitigation

Chrome now shows a prompt before connecting to a site over unencrypted HTTP, and the feature is on by default for all users. Enhanced Protection users also receive the Gemini and ClickFix protections.

Related items

• MediumPHP armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internetSame vendor · TechCrunch (Security)
• MediumCARLIY0S: CyberCartel's AI Attacks on Latin American BanksSame vendor · Straiker Blog
• InfoConversational Gemini navigation comes to Apple CarPlaySame vendor · The Verge (AI)
• InfoNew prize launches for books co-written with AISame vendor · The Guardian Technology
• MediumLiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI CredentialsSame vendor · Socket Blog