Fake Chrome Update Scam Could Harm Your Computer

You are looking at a web page when a warning jumps up. It says your browser needs a “Critical Update” before you can keep browsing. The warning looks like Chrome. It feels urgent. Clicking “Update” seems safest. That urgency is why the fake Chrome update trick works so well.

Recent reports link aggressive fake browser update alerts to a Chrome add‑on called Enable Right Click & Copy – Smart Unlock + OCR. The add‑on was first made as a legit tool to bring back right‑click and copy functions on sites that block them. Security researchers at Socket now say a bad actor bought the add‑on and added harmful code. About 70,000 people had it when the harmful code appeared, though not every user got the bad version. Google removed the add‑on from the Chrome Web Store on Aug. 14 after flagging it as possibly malicious.

FAKE WINDOWS UPDATE INSTALLS HIDDEN MALWARE

Fake Chrome update prompts can show up on normal sites and try to make users download unknown files instead of updating through Chrome itself. (David Paul Morris/Bloomberg via Getty Images)

The bigger lesson is not just one add‑on. Something you installed months ago and trusted can change after an update. Here is how the fake Chrome update trick works, how to notice the warning signs and what you can do to keep your browser and computer safe.

Missed CyberGuy LIVE? Watch the Protect Your Money replay

Our free CyberGuy LIVE class, Protect Your Money From Today’s Biggest Threats, has ended, but you can still watch the full replay and download our financial protection checklist. Kurt “CyberGuy” Knutsson shows five easy ways to guard yourself against AI scams, fraud, identity theft and financial hacks. You’ll learn to set bank alerts, strengthen login passwords, protect your phone number, freeze credit and keep retirement savings safe from unauthorized transfers. No technical skill is needed.

Get the free replay and checklist now at CyberGuyLive.com.

The warning can pop up while you visit an otherwise normal site. You may see words like “Critical Update Required” or “Update available.” The alert then pushes you to download something before you can keep browsing.

Chrome normally updates itself inside the browser. Google says Chrome usually updates automatically in the background. You can also check manually by opening Chrome and going to More > Help > About Google Chrome.

If a page asks you to download a .vbs script or an unknown .exe file to update Chrome, you should be very suspicious. Google specifically tells users to avoid strange pop‑ups that ask for updates. Instead, Google recommends going straight to the program or its official website.

Here is the part that can catch careful people off guard. You may have installed an extension when it had thousands of users, strong reviews and no obvious signs of trouble. You use it for months. Then the extension changes.

Google confirmed to CyberGuy that it looked into Enable Right Click & Copy – Smart Unlock + OCR. “We’ve investigated the extension and taken action to protect our users,” a Google spokesperson told CyberGuy.

New research from Socket on Aug. 27 shows the threat went beyond fake update alerts. Researchers linked the add‑on to a larger campaign using 19 Chrome and Edge extensions that could deliver harmful payloads. Those capabilities included stealing passwords, draining cryptocurrency wallets, injecting phishing pages and showing fake browser update lures. Socket says some of the extensions started as legit products before being bought and weaponized by the bad actor.

We have seen that pattern before. Earlier this year, researchers found that QuickLens – Search Screen with Google Lens changed owners before a malicious update arrived. The extension had previously earned a Featured badge from Google. Researchers later found harmful code that could inject scripts, display fake Google update prompts and target sensitive data. Google removed QuickLens from the Chrome Web Store.

CyberGuy has also reported on trusted browser extensions that later became spyware. One campaign affected 4.3 million users after extensions that began as useful tools eventually received malicious updates. That history changes how I look at browser extensions. A great rating tells you what people thought when they reviewed an extension. It cannot guarantee what a future update will do.

This recent extension case had another detail I think everyone should notice. Enable Right Click & Copy – Smart Unlock + OCR still had an average rating near 4.7 stars as reports of the fake update warnings appeared. That can happen because thousands of earlier positive ratings remain part of the overall score.

Meanwhile, recent reviews can begin filling with warnings. In this case, August reviews accused the extension of injecting fake Chrome update alerts. Several users said removing or disabling it stopped the prompts.

So, before installing an extension, look beyond the overall star rating. Read the newest reviews as well. CyberGuy previously covered another browser‑extension scam involving a fake ad blocker. That extension created computer problems and then tried to convince users to run dangerous commands to fix them.

One Reddit user who saw the recent fake update warnings said a full scan found nothing. The user later traced the pop‑ups to the Right Click extension.

A clean scan should never convince you that a suspicious browser warning is safe. The extension itself may be creating or injecting what you see inside the browser. Meanwhile, a downloaded malicious file may pose a separate threat if you open or run it.

Google’s Safe Browsing system checks installed extensions and downloads against known threats. Chrome can also disable extensions that Google identifies as malicious. Still, new threats can appear before defenses catch up. That is why your own reaction to a suspicious prompt remains important.

FAKE CAPTCHA SCAM CAN HACK YOUR COMPUTER

A fake Chrome update scam linked to a once‑legitimate browser extension can push users to download dangerous files disguised as critical updates. (Kurt “CyberGuy” Knutsson)

Seeing a Chrome‑branded warning inside another browser gives you a pretty good clue that something is wrong.

Users of Chromium‑based browsers like Brave and Opera have reported similar fake Chrome update prompts. Users connected those warnings with suspicious browser extensions rather than genuine browser updates.

That makes sense because Chromium‑based browsers can use many of the same types of extensions. If Opera suddenly tells you that Google Chrome desperately needs an update, do not follow the prompt.

You never need to trust a random webpage to tell you whether Chrome needs updating. On your computer:

Open Chrome > click the three‑dot menu > Help > About Google Chrome.

Chrome will check for updates on that page. If an update has already been downloaded, you may see an option to relaunch Chrome. If you do not see “Relaunch,” Google says you are running the latest version. That simple check can remove most guesswork from a scary update warning.

Look carefully at what you have installed. Google lets you turn an extension off temporarily or remove it completely. You can also open an extension’s details and see whether it can read or change data on every website you visit.

If you have Enable Right Click & Copy – Smart Unlock + OCR installed, I would remove it even if you never clicked or opened one of the suspicious downloads. Researchers found harmful abilities that went beyond the fake update alerts. Then restart Chrome, run a full security scan and change passwords for sensitive accounts you used while the extension was installed from another trusted device.

If you have several unknown extensions, disable them and turn back on only the ones you recognize and still need. For more help spotting warning signs, CyberGuy has a full guide explaining how to tell if your browser has been hijacked.

A few smart habits can lower your chances of turning a convincing pop‑up into a serious security problem.

If a webpage tells you to download an update, close the warning. Then go directly to Chrome > Help > About Google Chrome. Google also warns people to be careful when sites claim you need to download software because your device has a virus.

Strong antivirus protection adds another defense between a bad download and your computer. Look for antivirus software that provides real‑time protection, rather than relying only on occasional manual scans. Real‑time protection can watch files as they arrive and look for suspicious behavior before malware spreads.

Keep the antivirus software updated as well. New threats appear constantly, so outdated security software can leave gaps. If you clicked a fake update or ran a suspicious file, perform a full system scan. Follow the antivirus program’s instructions if it finds malware. Get my picks for the best 2026 antivirus protection winners for Windows, Mac, Android and iOS at CyberGuy.com.

Take a minute every few months to see what you have installed.

In Chrome on your computer:

Pay special attention to extensions that can read and change data on all sites you visit. Google calls this a higher‑risk permission because an extension could read, request or modify information on pages you visit. If an extension suddenly asks for broader permissions or you no longer remember why you installed it, I would remove it.

FAKE PARTY INVITATION SCAM CAN HIJACK YOUR COMPUTER

Browser extensions can become dangerous after ownership changes or malicious updates, even if they once had strong ratings and thousands of users. (Serene Lee/SOPA Images/LightRocket/Getty Images)

Do not rely only on the overall rating. Scroll down and read what people have written recently. A long history of five‑star reviews can hide a sudden change that users discovered only days ago. If recent reviews mention pop‑ups, malware or unexpected redirects, choose another extension.

For extra protection, open: Chrome > Settings > Privacy and security > Security > Enhanced protection. Google says Enhanced Protection can warn you about dangerous websites, downloads and extensions, including threats Chrome has not yet identified. It also does deeper checks on suspicious downloads.

If you clicked a fake update and it downloaded a .vbs, .exe or another unknown file, do not open it. Delete it. Then empty your Recycle Bin or Trash and run a full security scan. Chrome may also block files it thinks are dangerous, suspicious or unverified. Take those warnings seriously rather than overriding them to get the download through.

A data‑removal service cannot delete malware from your computer. However, it can lower another part of the scammer’s advantage: the amount of personal information about you that sits online. Data brokers can collect details such as contact info, past addresses and other identifying data. Scammers can use exposed data to make follow‑up phishing attempts feel more believable. For example, a scammer who already knows your name, phone number and where you live has more material to personalize a fake security alert. Data‑removal services work by sending removal requests to data brokers and other sites that publish personal information. They can also keep checking whether your information reappears. Reducing that digital footprint will never stop every scam. However, giving criminals less information to work with can make targeted attacks harder to personalize. Check out my top picks for data‑removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com.

If you actually ran the suspicious file, treat the computer as possibly compromised.

If you removed a suspicious extension and the warning still appears, keep looking for the cause.

What bothers me most about this fake Chrome update scam is how little suspicious behavior it needs from the person being targeted. You could have downloaded a useful extension from the official Chrome Web Store. It could have worked exactly as promised. It could even have thousands of happy users. Then something changes behind the scenes. That means we need to stop treating browser extensions as install‑once‑and‑forget‑it tools. Every extension gets a level of access to your browser. The fewer you keep, the smaller that exposure becomes. I would also make one rule non‑negotiable: Never update Chrome because a webpage tells you to download a file. Open Chrome’s settings and check the update yourself. That extra 20 seconds could save you from turning a convincing fake warning into a much bigger security headache.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

How much do you trust a browser extension’s star rating or download count when deciding whether it is safe to install? Let us know by writing to us at CyberGuy.com.

Kurt “CyberGuy” Knutsson is an award‑winning tech journalist who loves technology, gear and gadgets that make life better. He writes for Fox News & FOX Business and starts mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.