Chrome Adds ClickFix Warnings; Apple Blocks Identity Resolution in Safari

Chrome ClickFix Protection

Google announced that Chrome will now warn users who have Enhanced Protection enabled when they copy a command that matches a ClickFix attack pattern. ClickFix is a social engineering technique where attackers trick victims into pasting malicious code into the Windows Run dialog or the Mac Terminal. The malicious command often uses built-in tools such as PowerShell or cmd.exe to download further payloads.

When a user copies a suspicious command, Chrome scrubs personal data from the clipboard content and sends the remaining payload to Safe Browsing for analysis. If the system judges the command dangerous, a warning appears before the user can execute it. This approach aims to stop the infection chain at the earliest stage.

How the Warning Works

The warning is shown only to users who have turned on Enhanced Protection. The clipboard data is processed locally and only the command text is transmitted for evaluation. Google said the data is handled ephemerally and is never logged or used for model training. In addition, Chrome is introducing a taxonomy for Safe Browsing site warnings that separates suspicious sites from dangerous sites.

Chrome also expands on-device large language model checks to flag tech support scams, fake antivirus alerts and bogus browser update pages. The model evaluates page text for brand representation, page intent and a scam likeliness score, sending data off the device only when high confidence indicators are present.

Apple Safari Identity Resolution Blocking

Apple released new privacy protections in Safari and WebKit as part of the iOS, iPadOS, macOS and visionOS 27 updates. The changes block a practice called identity resolution, where third parties collect an email address during login or newsletter sign-up, convert it into a persistent tracking identifier and store that identifier on the website.

Safari now blocks network requests to the identity resolution infrastructure at the domain level, preventing the third party from receiving the email address. Apple said blocking cross-site cookies alone is insufficient because the tracking industry has moved to a post-cookie era, and the new controls add a stronger layer of protection.

Sources: The Hacker News