Chrome Incognito May Get Real-Time Scam Checks

Here's something most people don't know about Chrome's Incognito mode: it can be slightly worse at catching brand-new scam sites than a normal window. Google is now working on closing that gap, according to a Chromium code change spotted by Windows Report.

What happened

The change adds real-time Safe Browsing checks to Incognito and Guest modes, for people using either Standard or Enhanced protection. It sits behind an experimental flag and is switched off for now, and Google hasn't said when, or whether, it will reach the stable version of Chrome. Android Authority and Digital Trends picked up the same finding.

To see why it matters, you need the background. In March 2024, Google moved Chrome's default Standard protection to real-time checks. Before that, Chrome compared sites against a list stored on your device, refreshed every 30 to 60 minutes. Google's own figure was that the average malicious site lasts less than 10 minutes, so that list was often already out of date. Real-time checks fixed it, and Google said it expected to block 25% more phishing attempts.

Incognito didn't fully get that upgrade. Google's support docs say private windows can fall back to the on-device list, so a scam page that went live 15 minutes ago might not get flagged there. The new code is meant to give Incognito and Guest the same live lookups while keeping the temporary security data in memory, so nothing from the private session gets written to disk.

Why it matters

People use Incognito for exactly the kind of browsing where scams show up: clicking an unknown link, checking a "too good to be true" deal, or logging into an account on a shared PC. Guest mode is common on family and office computers too. Those are the moments when a fresh phishing page does the most damage.

It's also a reminder that Incognito was never a security feature. It stops Chrome saving your history on that device, and that's it. Websites, your employer and your internet provider can still see what you do.

What to do now

• Check your protection level. On desktop, go to Settings, then Privacy and security, then Security. On Android, it's Settings, Privacy and security, Safe Browsing. Make sure it's on Standard at the very least, not "No protection".
• Think about Enhanced protection if you click a lot of links from messages or email. It shares more data with Google in return for stronger checks on sites, downloads and extensions.
• Keep Chrome updated. When this ships it'll come in a normal update. Open the three-dot menu, then Help, then About Google Chrome to check.
• Don't treat Incognito as safe mode. If a link feels off, don't open it anywhere.

My take

This is a small change that I'd quite like to see land. I've always found it odd that the private window, which many people treat as the "careful" option, got the older, slower check. Scam sites now pop up and vanish within minutes, and they're aimed hard at people in India and everywhere else through fake delivery texts, bank alerts and UPI refund links. A 30-minute-old list just doesn't cut it.

The privacy side seems to be handled the right way. Standard protection already hides your IP address through a privacy server and only sends a partial, scrambled form of the address, and the new code keeps Incognito's temporary keys out of storage. I'd still like Google to say plainly what changes for private windows when it ships.

Until then, the setting check above takes 30 seconds. If Chrome has also been slowing your PC down, our guide on fixing Chrome using too much memory is worth a look, and you can catch up on the last big patch in our post on the Chrome 156 security update.