Chrome Adds a Suspicious-Site Tier Between Safe and Blocked

Google is adding a suspicious-site warning tier in Chrome for websites that show traits linked to phishing, malware, and scams. The Verge

The change creates a middle verdict between no warning and a full block. Google describes a suspicious-site verdict as lower confidence with possible risk of harm. It describes a dangerous-website verdict as higher confidence with high risk of harm. Chrome will now state when it is unsure, rather than staying silent or blocking outright.

The interface reflects that distinction. A suspicious-site notice appears as a pop-up on desktop and mobile, with the underlying page still visible but darkened. A dangerous-site warning takes up almost the entire screen and replaces the website with a solid red background.

The suspicious warning includes a "Mark as safe" option for users who want to proceed despite the flag. Alongside the redesign, Google improved Gemini-powered scam detection for Enhanced Protection users, meaning people who turn on Chrome's stricter security setting with stronger checks.

The two-level model is not new to Chrome. The warnings build on a suspicious-versus-dangerous system for file downloads introduced in 2024. The launch also follows earlier trust work. Google introduced the Suspicious Site Reporter Extension to give experienced Chrome users a way to report suspicious sites. Google Security Blog Chrome later added on-device machine learning, where checks run on the computer itself, to warn about deceptive or spammy notifications. Chromium Blog Separately, Chrome is scheduled to enable 'Always Use Secure Connections' by default in October 2026 and to warn users before loading public HTTP sites, which are connections without encryption. Search Engine Journal

Looking at what this means for practitioners, the notable choice is to expose how confident the classifier is instead of forcing every decision into block or allow. A lower-confidence tier gives Chrome a place to express suspicion without claiming certainty. That helps on borderline pages where signals are mixed and a binary answer would claim more than is known.

In my view, the operational trade will feel familiar to anyone who runs detection tooling. Fewer hard blocks should mean fewer cases where legitimate users are fully stopped. The cost is a gray area that asks for user judgment at a difficult moment. The pop-up treatment, the darkened page underneath, and the explicit "Mark as safe" control look like an attempt to balance that tension, with friction present but limited and context left visible.

The broader context here is a browser moving from transport guarantees toward content judgment. Enabling 'Always Use Secure Connections' by default and warning before public HTTP loads address the connection. Suspicious-site verdicts and improved scam detection for Enhanced Protection users address the destination, even when the connection itself is sound. For enterprise defenders and site operators, that calls for a different triage motion.

Looking ahead, if the tier works as intended, the gain is practical rather than dramatic. Users get earlier signal on borderline pages. Security teams get fewer binary outcomes to explain. And the web keeps working.