If you open your browser and see an urgent, full-screen message demanding that you update Google Chrome immediately, stop before clicking.
An alert claiming your browser is blocked, outdated or at risk is not necessarily a helpful security feature. It could be a malware attack disguised as a routine browser update.
Recent campaigns have used compromised websites, browser notifications and malicious browser extensions to display convincing fake update warnings. The goal is to pressure users into downloading a malicious file, running a script or installing software that can compromise their computer.
The good news is that recognising the warning signs and following a few simple steps can significantly reduce the risk.
How the fake Chrome update scam works
These attacks rely on two things: visual disguise and manufactured urgency.
Threat actors create web overlays that imitate familiar browser branding. The fake warning may include copyright notices, links to terms of service, progress bars, countdowns or official-looking security language.
The message usually takes one of two forms:
- The access block: The alert claims that access to websites has been restricted until you install a required security update.
- The account or data threat: The warning says Chrome will stop working on a particular date and suggests that failing to update could result in a complete reinstallation, potentially affecting saved passwords, bookmarks and browsing history.
The message is designed to make you act before you have time to question it.
If you click Update Chrome, the browser does not retrieve a legitimate update from Google. Instead, the button may download a malicious payload, such as an executable .exe file, VBScript .vbs file, ZIP archive or another installer.
If you open the file, it could:
- Steal usernames and passwords
- Install spyware or an information stealer
- Create unauthorised remote access
- Download additional malware
- Monitor browsing activity
- Disrupt or encrypt files
Some campaigns may also instruct users to copy and paste commands into PowerShell or install a “security certificate”. These are serious warning signs. Do not follow instructions from an unexpected web pop-up.
Why compromised browser extensions are part of the problem
The issue is not necessarily a breach of Google Chrome itself. In many cases, the malicious pop-up is delivered through a compromised browser extension or a hacked website.
Attackers often use a bait-and-switch approach:
- They create or purchase a popular extension that appears harmless, such as a utility tool, screen capture helper or copy-and-paste assistant.
- They allow it to build a large user base and collect positive reviews.
- Once the extension is trusted, they push a malicious update or configure it to load scripts from an external server.
The extension can then inject advertisements, redirect users or display fake update warnings across otherwise legitimate websites.
Because malicious code may be fetched dynamically from a remote server, traditional antivirus tools may not detect the activity immediately. The most serious consequences can occur only after a user downloads and executes the malicious payload.
This type of activity is not limited to Chrome. Similar browser-extension and fake-update scams can affect other browsers, including Brave, Opera, Edge and Firefox.
Warning signs of a malicious browser extension
A high download count or a collection of positive reviews is no longer a guarantee that an extension is safe. Established extensions can be acquired or compromised after they have gained users.
Review your extensions regularly and look for warning signs such as:
Overreaching permissions
A simple calculator, screen cropper or dark mode tool should not necessarily need permission to “read and change all your data on all websites you visit”.
The more powerful the permission, the greater the potential impact if the extension is compromised.
Sudden ownership or branding changes
Be cautious if an extension you have used for years suddenly has:
- A different developer name
- A new privacy policy
- A redesigned logo
- Brand-new features you did not request
- A new description with unclear explanations
These changes do not automatically mean the extension is malicious, but they are worth investigating.
Unusual browser behaviour
Unexpected changes may include:
- Extra advertisements inserted into search results
- Redirects when visiting familiar websites
- A changed search engine or home page
- New tabs opening without permission
- Aggressive browser update pop-ups
- Unusual CPU or network activity
Vague names and poor descriptions
Be wary of extensions with generic, keyword-stuffed names or descriptions containing broken grammar and unclear claims. For example, names combining several unrelated functions may be attempting to attract searches rather than clearly explain what the tool does.
How to check whether a Chrome update is genuine
Chrome updates should be checked through Chrome’s built-in settings, not through a web page or pop-up.
To check manually:
- Open Chrome directly.
- Click the three vertical dots in the top-right corner.
- Select Help.
- Choose About Google Chrome.
You can also enter chrome://settings/help directly into the address bar.
Chrome will check Google’s official update service and install a legitimate update if one is available. Google’s official Chrome update guidance provides further information.
A website should never require you to download a separate “Chrome update” installer to continue browsing. If a web page says your browser is blocked until you install a file, treat the message as fake.
Step-by-step browser security audit
If you have seen suspicious pop-ups but have not downloaded or opened anything, use the following process.
1. Close the suspicious page
Close the tab or browser window displaying the warning. Do not click buttons such as Update, Scan, Allow, Fix or Remove threat.
If the page will not close normally, close the browser using your operating system’s standard controls.
2. Check for browser notifications
Some fake alerts continue appearing because a website has been granted permission to send notifications.
In Chrome, open:
chrome://settings/content/notifications
Review the sites listed under Allowed to send notifications. Remove any website you do not recognise or do not explicitly trust. You can also make notification permissions more restrictive so websites must ask before sending alerts.
3. Audit your browser extensions
Open Chrome’s extension manager at:
chrome://extensions
Remove any extension that:
- You do not recognise
- You no longer use
- You did not intentionally install
- Was installed around the time the pop-ups began
- Has a safety warning from the browser or extension store
Do not simply leave unnecessary extensions disabled. Uninstall them wherever possible.
The same principle applies to other browsers. Use each browser’s internal extension or add-on manager rather than clicking a link in a warning message.
4. Restrict permissions for trusted extensions
For extensions you choose to keep, select Details and inspect the Site access settings.
Where possible, change access from On all sites to On click or On specific sites. A price tracker, screen tool or theme rarely needs permanent access to sensitive websites such as email, banking or administration portals.
5. Check browser settings
Review your browser’s:
- Startup pages
- Search engine
- New tab settings
- Pop-ups and redirects
- Intrusive ads permissions
Reset anything that changed without your approval. If unusual behaviour continues, use the browser’s built-in reset option.
What to do if you downloaded or opened a suspicious file
If you ran a file such as ChromeUpdate.exe, opened a suspicious script, installed an unexpected certificate or pasted code into PowerShell, treat the device as potentially compromised.
Take these steps:
- Disconnect the device from the internet. Turn off Wi-Fi or disconnect the network cable.
- Do not enter passwords or access sensitive accounts on that device.
- Contact your IT support provider and explain exactly what happened.
- Run a full scan using reputable endpoint protection.
- On Windows, use Windows Security and consider a Microsoft Defender Offline scan if the issue persists.
- Remove suspicious applications recently installed around the time of the incident.
- Change important passwords from a separate, trusted device.
- Enable two-step verification on important accounts.
- Monitor accounts for unusual activity.
If malware continues to return after scanning and cleanup, system recovery or a complete rebuild may be necessary. Do not assume that deleting the downloaded file alone has resolved the problem.
For businesses, a suspected infection should be treated as an IT security incident. Prompt investigation can help protect shared accounts, cloud data and other connected devices.
Golden rules for safer browsing
A few simple habits can reduce your exposure to fake update scams:
- Keep your browser extensions to a minimum.
- Install extensions only from reputable sources.
- Prefer official tools from verified software vendors.
- Review extension permissions regularly.
- Never install updates from web pop-ups or email links.
- Never copy and paste commands because a pop-up tells you to.
- Do not install certificates or remote-access tools unexpectedly.
- Pay attention to browser warnings about removed or unverified extensions.
- Use two-step verification on email, cloud storage and other important accounts.
- Keep operating systems, browsers and business applications updated through their official update mechanisms.
Need help reviewing your business browser security?
Browser extensions are often overlooked during a security review, particularly when employees use different devices, browsers and productivity tools.
A structured review can identify unnecessary extensions, excessive permissions, risky notification settings and other browser configuration issues before they become a larger problem. Cloud Computer Company can also help businesses review their broader Google Workspace health and security, improve user awareness through security training and provide ongoing managed IT support.
When a pop-up claims your browser is broken, blocked or under immediate threat, pause before acting. Close the page, open your browser’s official settings and verify the update directly.
Urgency is a malware author’s favourite weapon. Taking a moment to verify the message could prevent a serious security incident.
About Mathew Hoffman
Mathew Hoffman started his IT career in 1981 and has held senior roles with State Bank of NSW, Minet Australia, Wilhelmsen Lines and Rothmans of Pall Mall. He also contributed to the technology work supporting the Sydney 2000 Olympics.
Since 2001, Mathew has provided IT consultancy to small and medium businesses. He became an original Google Partner in 2008 and re-branded the business as Cloud Computer Company in 2017. Based in Noosa, Mathew enjoys cricket, which he has played and coached in Sydney and on the Sunshine Coast, as well as family, the beach and golf.
