Chrome now warns about ClickFix. Is that enough?
In October 2026 Google added a ClickFix warning to Chrome. It is good news. Here is what it covers, what it needs, and where a security extension with a console still makes the difference — especially for companies.
In short
- Chrome’s warning works only for people who turned on Enhanced Protection.
- When a suspicious command is copied, Chrome removes personal data from it and sends it to Google Safe Browsing to decide.
- It warns the user. It does not tell the company’s IT team that it happened.
- ByteMantle decides locally, replaces the harmful command, works in Chrome and Edge, and reports each attack to your console.
What Chrome added
With Enhanced Protection on (Settings → Privacy and security → Security → Enhanced protection), Chrome now looks at commands copied from web pages. If a copied text looks like a ClickFix script, Chrome strips personal data from it and sends it to Safe Browsing; when the service judges it dangerous, Chrome shows a warning. The same update added a lower-confidence “suspicious site” warning and server-side scam detection.
If you use Enhanced Protection, keep it on: it is a useful layer.
Where the gaps are
- It is opt-in. Standard protection is the default; most people and many managed fleets never switch to Enhanced.
- It is a warning, not a removal. The command stays on the clipboard if the user clicks past the warning.
- It sends copied text to Google. Some organisations cannot enable Enhanced Protection for privacy or policy reasons.
- Nobody else knows. The security team does not learn which user met which lure on which compromised site, so the next colleague meets the same page.
- Chrome only. Edge users and mixed fleets are not covered by this feature.
Side by side
| Chrome warning | ByteMantle | |
|---|---|---|
| Needs a setting changed | Yes, Enhanced Protection | No, on after install |
| Where the decision is made | Google Safe Browsing | Locally, in the browser |
| What happens to the command | Warning shown | Replaced with a harmless message, warning shown |
| Fake CAPTCHA page detected | When Safe Browsing already lists the site | Yes, from the page’s content and instructions |
| Browsers | Chrome | Chrome and Edge |
| Company visibility | No | Incident story in the console, SIEM forwarding |
| Block the site for everyone | No | Yes, on the browsers you choose |
Which one do you need?
- At home: turn on Enhanced Protection if you are comfortable with it, and add ByteMantle for local protection that removes the command itself. Both are free.
- In a company: you need to know when it happens. ByteMantle gives every browser the same protection by policy and gives IT the full story of each attempt — where it came from, the compromised site, the command, the outcome — so the lure can be blocked for everyone.
Questions people ask
How do I turn on Chrome’s ClickFix protection?
Open Chrome Settings, go to Privacy and security, then Security, and choose Enhanced protection. The ClickFix warning is part of it.
Does Chrome read everything I copy?
According to Google’s description, Chrome checks text that looks like a ClickFix command and sends it, with personal data removed, to Safe Browsing for analysis. It does not describe sending everything you copy.
Does ByteMantle send my clipboard anywhere?
No. The analysis runs in your browser. Only if your browser is connected to a ByteMantle console does the evidence of a detected attack, such as the harmful command, go to that console.
Stop these attacks before anything runs.
Free browser protection for everyone, in Chrome and Edge. One console for your whole company when you need it.