Quick answer: A genuine Chrome update never appears as a pop-up on a webpage. It only ever shows up when you go directly to Chrome’s menu, then Help, then About Google Chrome. Any update prompt appearing inside a webpage, especially one using urgent language like “Critical update required,” is fake and almost certainly leads to malware, regardless of how convincingly it copies Google’s logo and design.

Fake Chrome update pop-ups have surged in 2026, with security researchers tracking multiple active campaigns hitting thousands of compromised websites at once. The scam works because it borrows something genuinely familiar, Chrome’s real update process, and stages a convincing fake version of it at exactly the moment you’re least suspicious: mid-browse, on a page you already trusted.

The One Rule That Settles It Every Time

Chrome does not update through a pop-up on a website. Full stop. Real Chrome updates only ever happen through the browser’s own settings, never through a webpage telling you to click something. If you remember nothing else from this article, remember this: any update prompt appearing inside a page you’re browsing is fake, no exceptions.

How to Check for a Real Update in 10 Seconds

Instead of trusting any pop-up, check directly:

1. Click the three-dot menu in the top-right corner of Chrome
2. Select Help, then About Google Chrome
3. Chrome will show “Chrome is up to date,” or begin downloading a real update automatically

You can also type chrome://settings/help directly into the address bar and press Enter. No website, no download button, no file appears in your Downloads folder. That’s the entire legitimate process, and it never looks like what the scam pop-ups show you.

The Warning Signs of a Fake Update Prompt

• Urgent, alarming language. Phrases like “Critical update required” or “You can’t use this site unless you update” are designed to create panic and override careful thinking. Genuine update notifications are calm and never framed as an ultimatum.
• It appears on a webpage, not in Chrome’s own settings. This is the single most reliable tell. Chrome’s update process lives entirely inside the browser’s menu, never on a site you’re visiting.
• It asks you to download and run a file. A genuine browser update never requires you to manually download a package and grant it permission to run. If a prompt wants you to click Open, Allow, and Run on a downloaded file, that’s not how real updates work.
• Sloppy visual details. Look for inconsistent corner radii, off-center text, slightly wrong fonts, or colours that are close but not quite right. Scammers can copy Google’s logo pixel-for-pixel, but small layout inconsistencies often give away a rushed fake.
• An audio alarm or repeated alerts. Real Chrome update notifications are silent. A beeping sound paired with an urgent message is a strong signal of a scam.
• A suspicious file extension. If the download has a name like a random string of letters and numbers ending in .vbs, that’s an executable script commonly used to modify system settings, not a browser update file.

Why Copying Chrome’s Design Doesn’t Prove Anything

It’s worth understanding why this scam is so convincing: the pop-up you see is just HTML, CSS, and JavaScript rendered inside your own browser. That means anyone can reproduce Chrome’s visual style exactly, the logo, the colours, the button shapes, all of it. Visual similarity to a real Google product proves absolutely nothing about legitimacy. The only things that actually matter are where the prompt appears (a real update never appears inside a webpage) and how the update process actually works (through Chrome’s own menu, never a download).

How These Fake Pop-Ups Actually Get Onto Websites

Contrary to what many people assume, seeing a fake update prompt doesn’t necessarily mean your device is infected, it usually means the website itself has been compromised. Attackers gain access to a legitimate site, sometimes through weak credentials, sometimes by exploiting an outdated plugin, then inject code that displays the fake update popup to visitors. Security researchers have also traced a related pattern: some fake update pop-ups are triggered not by a hacked website at all, but by a malicious browser extension already installed on your own device, one that looked legitimate and had thousands of genuine downloads and a high star rating before quietly starting to serve malicious content.

If You See One, Do This

1. Close the pop-up or the browser tab immediately. Do not click anything inside it, including an “X” that might itself be part of the fake interface, close the tab entirely instead.
2. Do not download or run anything it offers. If a file has already downloaded, do not open it.
3. Check for a real update the correct way, through Chrome’s own Help menu, as described above.
4. Delete any downloaded file without opening it, then empty your Downloads folder and Trash or Recycle Bin.
5. Run a full security scan with updated antivirus software as a precaution, even if you didn’t run anything.

If You Already Clicked and Ran the File

1. Disconnect the device from the internet to limit further damage while you work.
2. Run a full malware scan using trusted, updated security software.
3. Change important passwords from a separate, clean device, not the potentially infected one, in case a keylogger is present.
4. Review your browser extensions for anything unfamiliar, since some fake update campaigns are triggered by a compromised extension already on your device.
5. If this happened on a work device, report it to your IT team immediately rather than trying to quietly fix it yourself.

An Extra Layer of Protection

Chrome’s Enhanced Protection setting, found under Settings, then Privacy and security, then Security, provides deeper checks on suspicious downloads and can warn you about dangerous sites and extensions Chrome hasn’t previously identified. It won’t catch everything, but it closes a meaningful gap for anyone who browses regularly.

Common Questions

Is it ever legitimate for a website to tell me to update Chrome?
No. A website can never trigger or deliver a genuine Chrome update. Real updates only happen through Chrome’s own Help menu or automatically in the background, never via a prompt on a webpage.

I downloaded the file but didn’t open it. Am I safe?
Almost certainly yes. A downloaded file does nothing until it’s executed. Delete it from your Downloads folder, empty the trash, and run a security scan as a precaution.

Can this happen even on a website I trust and visit regularly?
Yes. These pop-ups often appear because the legitimate site itself has been compromised by attackers, not because the site is inherently malicious. A trusted site showing this prompt is not evidence the site is fake, just that it may have been hacked.

Does this only affect Google Chrome?
No. Users on other Chromium-based browsers like Brave and Opera have reported identical fake “update Chrome” pop-ups, and similar scams impersonate Firefox and other browsers too. The same rule applies regardless of which browser you use: check for updates only through the browser’s own menu.

What file extensions should I be especially suspicious of?
Files ending in .vbs or .exe, particularly with a random string of letters and numbers as the filename, are common in this scam and can modify your system settings once run.

The Bottom Line

The single test that never fails: a real Chrome update never comes from a webpage. It only ever appears when you check directly through Chrome’s own Help menu. Everything else, the urgent language, the copied logo, the alarming pop-up, is theatre designed to get you to skip that one check. If you remember to go to the source yourself rather than trusting what a page tells you, this entire category of scam loses its power.

Related: Virus popups and Browser extensions.