Chrome Adds New “Suspicious Site” Warnings — Here’s When You’ll See Them

A website no longer has to be confirmed dangerous for Chrome to raise the alarm. Google’s browser can now flag suspicious pages before they meet the threshold for a stronger security warning.

In an October 20, 2026, announcement, Google detailed a new category of warnings for websites showing signs of deception. Available through Safe Browsing’s optional Enhanced Protection mode, the alerts were previously documented in Chrome 152, released August 25, 2026.

Unlike Chrome’s full-page red danger warnings, the new suspicious-site alerts appear as bypassable pop-ups. Employees can proceed after dismissing one, making appropriate responses to browser warnings an important part of workplace security.

How Chrome’s new warnings work

Chrome now distinguishes between suspicious sites, which carry a lower-confidence risk assessment, and dangerous sites, which Google identifies as high-risk threats.

According to Google’s security announcement, suspicious-site alerts use distinct colors, icons and wording. The Chrome 152 release notes confirm that they appear as bypassable pop-ups, while dangerous websites continue to trigger full-page red warnings.

A suspicious warning doesn’t necessarily mean a website contains malware. Users should examine unfamiliar addresses and avoid entering credentials or payment details until they can verify a site’s legitimacy.

Attackers can also exploit trusted-looking browser tools. In July 2026, Microsoft uncovered a fake Perplexity Chrome extension that redirected searches through attacker-controlled servers, demonstrating how legitimate-looking services can conceal malicious activity.

Google has also moved its Gemini-powered scam detection from an on-device model to a server-side system. It examines page content for deceptive behavior, including fake antivirus alerts and fraudulent browser updates, while Safe Browsing considers domain reputation and other signals.

Google says page text is analyzed only when strong scam indicators appear and isn’t retained or used to train models.

The announcement also covers ClickFix scams, which trick users into running malicious commands disguised as troubleshooting instructions. For Enhanced Protection users, Chrome can check suspicious copied commands and warn when its analysis identifies dangerous content.

Enhanced Protection and enterprise controls

The new suspicious-site warnings require Enhanced Protection. Chrome’s default Standard Protection continues to check for known phishing sites, malware and other threats.

Administrators can manage the new warnings through Chrome’s existing SafeBrowsingProtectionLevel policy. They can also use SafeBrowsingAllowlistDomains to exclude specified sites from triggering warnings, as confirmed in Google’s Chrome Enterprise release notes.

Those exceptions warrant scrutiny, particularly when previously trusted sites become compromised. Browser-management controls have also attracted attackers: In August 2026, Google was developing defenses against extensions that abuse enterprise policies on unmanaged personal devices.

Employees can review their protection level under Chrome’s Settings > Privacy and security > Security, unless administrators restrict changes. Google’s Safe Browsing privacy documentation explains the additional browsing information shared under Enhanced Protection.

Browser updates remain equally important. Chrome 154, released in September 2026, patched 108 security vulnerabilities, including 11 rated Critical, addressing risks that website warnings cannot prevent.

Administrators should confirm which managed browsers use Enhanced Protection, review domain exceptions and reinforce appropriate responses to alerts. Earlier detection helps, but employees still need to recognize when a suspicious page isn’t worth the risk.

Read more: Google’s trial of twice-weekly Chrome security updates could further change how organizations test and deploy browser patches as vulnerability discovery accelerates.