Google Chrome is now monitoring what users copy to their clipboard and preemptively warning them against running their own commands — the latest move in Big Tech's campaign to treat every American like a child who can't be trusted with their own machine.
The new feature targets what Google calls "ClickFix" attacks — social engineering scams where bad actors trick users into pasting malicious code into Windows Run or Mac Terminal under the guise of fixing a fake error, like a counterfeit Cloudflare or reCAPTCHA prompt. According to The Hacker News, these attacks bypass conventional browser security because they shift the infection out of Chrome and into the operating system itself. The tactic is effective precisely because it flips traditional phishing on its head: the user opens the door willingly.
Google's fix is to watch you more closely. When a user with Enhanced Protection enabled copies a suspicious command, Chrome scrubs the clipboard of personal information and sends the payload to Google's Safe Browsing servers for analysis. If the system deems the command dangerous, a warning pops up before the user can execute it. Google told The Hacker News that "Chrome now detects when an Enhanced Protection user is tricked into copying suspicious commands."
In other words: Google reads your clipboard, strips what it considers your personal data, and phones home to ask permission for you to proceed. The company insists that any page content sent off-device is "processed ephemerally — meaning it is never logged, retained or used to train models." Americans have heard similar promises before. The track record of tech giants honoring data minimization pledges is, to put it charitably, uneven.
Google is also expanding its site warning taxonomy. A new "Suspicious" category will sit below the existing "Dangerous" classification, flagging sites that show "deceptive patterns commonly associated with known malicious sites" but where Safe Browsing lacks "enough confidence" to call them outright dangerous, as Digital Trends reported. Known malicious sites still get the familiar red full-page warning; the new tier gets a different color and format.
Digital Trends framed the Suspicious category as a helpful safety net, noting it "could help older users or people unfamiliar with the tricks used in phishing and other online scams." That's the paternalism in plain view: Google decides you're not smart enough to evaluate a website on your own, so it intervenes before it even has confidence you're in danger. The Hacker News, by contrast, stuck to the technical mechanics and the ClickFix threat vector without editorializing about who needs the help.
Behind both features sits Google's AI apparatus. Chrome is moving from an on-device Gemini model to a more powerful server-side version that evaluates "the brand represented, the intent of the page, and a scam likeliness score," according to The Hacker News. That shift from on-device to server-side processing is the quiet part: local analysis kept your data on your machine. Server-side analysis sends it to Google. Digital Trends mentioned the Gemini upgrade but buried the on-device-to-server shift; The Hacker News noted the ephemeral processing claim but not the architecture change itself.
Google also announced Financial Services Verification for advertisers in the U.S. and Canada — a program to validate that financial ads come from authorized providers. Another layer of gatekeeping, another set of credentials Google decides are legitimate.
The open question isn't whether ClickFix scams are real — they are. It's whether the cure is worth the cost: a browser that reads your clipboard, sends your data to corporate servers for pre-approval, and warns you about sites it isn't even sure are dangerous. Every time Google adds a "protection," it adds another pipeline to its own infrastructure. The nanny state always arrives wrapped in safety.
