Browsers and popups

The Full-Screen Virus Popup That Locks Chrome, October 2026

Updated 6 October 2026

You open a link from a text or a search result, and a screaming red page slams over your browser. It says your computer is infected, your bank account is leaking, the FBI has logged your IP. The only escape is the green 'Fix Now' button, which leads to a 1-800 number staffed by someone who sounds exactly like a Microsoft technician, because that is the point. You are one click away from giving a stranger remote access to the machine you do your taxes on, and they have not earned your trust, they have stolen a minute of your fear.

What the full-screen virus popup actually is, and why Chrome locks you in

The October 2026 wave uses a trick called the Fullscreen API, which any website can call in a modern browser. The page calls requestFullscreen() on itself, and Chrome obliges by hiding the address bar, the tabs, and the back button. There is no malware on your machine at this point. There is not even a virus scan running. The page is just a single HTML file with a background image, a few lines of JavaScript, and a popup loop that re-opens itself every time you try to close the tab. Some of these pages also play a high-pitched audio loop, which is there to stop you thinking clearly, not because your speakers are compromised.

The reason your real back button stops working is that the page traps keyboard focus and uses window.history.pushState to fill your history with dummy entries, so each press of back just bounces you to another fake 'security warning'. The 'virus found: 47' counter ticking up in the corner is animation. The list of infected files is the same string copied 47 times. The IP address it shows you is the public address of your home router, which is technically correct and totally useless, and that combination is intentional, because a detail that is half right is harder to dismiss than one that is fully wrong.

You were probably funnelled in from one of three places: a hacked ad on a low-rent streaming site, a push notification you accidentally allowed six months ago on a recipe blog, or a redirect from a search result for a free PDF of a popular novel. The scammers buy cheap push-subscribe traffic, then blast the same domain across hundreds of expired WordPress blogs so that when the popup does its thing, the URL in your address bar looks like security-center-update.[something].click. That .click TLD is a clue. Legitimate Microsoft, Apple, and Norton domains do not use it.

The popup, decoded: what every line is trying to do to you

Almost every variant in October 2026 shares a common script, and once you can read it, the whole thing loses its power. The first block imitates a Windows Defender or System Preferences alert, because the page checks your userAgent string and shows the matching skin. The second block quotes a real-sounding certificate number and a 'support ID', which is just a session token the scammers use to recognise you if you call back a second time. The third block is the timer, which counts down from five minutes and threatens to wipe your hard drive if you do not act. Your hard drive cannot be wiped from a webpage. There is no browser API for that, and if there were, every online banking session in the world would be a hostage situation.

The four buttons are the part that costs people real money. 'Fix Now' dials a 1-800 or 1-888 number through a Skype-style redirect. 'Allow notifications' is the browser notification scam in a different hat, and clicking it gives the site permission to push popups at your desktop even when the tab is closed. 'Download Protection' drops a file called setup.exe or SecureInstaller.dmg, which is a real piece of malware, usually a remote access trojan called Amadey or a clipboard hijacker that swaps your crypto wallet address. The fourth, smallest link, usually grey and bottom-right, is the one that says 'Continue unprotected'. That is the only safe button on the page, but it does not always appear.

The voice loop, when it is enabled, says things like 'Your device has been compromised, do not turn off your computer' in a calm male voice. The calm is the technique. People who are panicking do not pause to think about why Microsoft would have a recording of their voice. If you do call, the 'technician' on the other end will ask you to install AnyDesk, TeamViewer Quick Support, or a new one this month called RustDesk, then ask you to open Event Viewer, where every Windows computer has a long list of red 'critical' errors that look terrifying and mean nothing. From there, the script moves to a 300 to 800 dollar 'lifetime protection plan' paid by gift card or wire, and the moment the screen-share ends, the same fake technician sells your card numbers on a Telegram channel before lunch.

How to actually close the popup, on Windows, on Mac, on iPhone, on Android

The escape is the same in every browser, and it does not involve the popup's own buttons. On Windows, press Ctrl + Shift + Esc to open Task Manager directly, find your browser in the list, right-click and choose End Task. The full-screen site cannot trap the Task Manager, because Task Manager runs as a separate process at a higher privilege level. On Mac, press Command + Option + Esc to open Force Quit, select your browser, and click Force Quit. The popup will not reappear, because it never lived in your operating system, it lived in the browser, and you have just killed the browser. When you reopen, do not hit Restore Previous Session, because one of the tabs in that session is still the trap, and it will load you straight back in.

On a phone it is slightly different, because there is no Task Manager keybind. On iPhone, open the App Switcher by swiping up from the bottom edge, find the browser card, and flick it upward. On Android, do the same or hit the X on the browser card. If the page is using the Web Push API to lock you out, you can also switch to airplane mode, then close the tab, then close the browser, then switch back. The popup cannot reach you without a connection. The reason you should not just hit the home button and walk away is that the audio loop, if there is one, will keep playing, and many variants are now using the Screen Wake Lock API to keep the screen on until the battery is dead, which is annoying and, in a few cases, has led to people plugging the phone into a charger overnight and getting a small burn on the pillow.

Once the browser is closed, the cleanup is small but worth doing. Open Settings, find Site Settings or Notifications, scroll to the top of the allowed list, and remove any entry you do not recognise. On Chrome for desktop this lives at chrome://settings/content/notifications. On Safari it is under Websites, then Notifications. On iPhone it is Settings, then Apps, then your browser, then Notifications. Most of the October 2026 variants use one of three domains for the push permission, and if you see cdn-push[.]live, secure-allow[.]click, or notif-center[.]xyz, block them now and never think about them again.

What to do if you already clicked, paid, or let someone into your computer

If you only clicked 'Allow notifications' and then closed the tab, you are mostly fine. Remove the notification permission as described above, run a scan with your real antivirus, and clear the browser's site data for the past 24 hours. If you ran a file the popup asked you to download, treat the machine as compromised. Disconnect from the network, boot into safe mode, and run a full scan. On Windows, the built-in Microsoft Defender offline scan at ms-settings:windowsdefender is enough to catch the common droppers, and Malwarebytes' free version will mop up the rest. On a Mac, EtreCheck and the built-in XProtect are usually sufficient unless the file was an unsigned .pkg, in which case a wipe is the safe play.

If you paid, the recovery path depends on the payment method. Gift cards are the worst case, because the scammers redeem them in seconds and the retailer cannot reverse them once the PIN is used. All major US and UK gift card brands, including Apple, Google Play, Steam, and Target, now publish a fraud hotline; call within 24 hours and there is a small chance the balance is still on the card. Credit card charges can be disputed as fraud, and the merchant descriptor will usually contain 'TECH SUPPORT' or 'DIGITAL SVCS', which makes the chargeback easier. Bank transfers are hard to recover, but the Faster Payments scheme in the UK has a same-day recall process if the receiving account is still flagged as active, and in the US, wire recalls through the originating bank can sometimes catch the funds if reported within a few hours.

If you let a stranger into your machine through AnyDesk, TeamViewer, or RustDesk, the recovery is more serious. Uninstal the remote access tool, change every password you typed while the screen was shared, starting with email and banking, and call your bank to flag the account for outbound wire and Zelle review. The remote access trojan these tools often drop will sit in your system and wait, harvesting new passwords for weeks, so a clean reinstall is the honest answer if you can manage one. Pull the tax documents, the photo library, and the browser profile you want to keep, then wipe and reload. The October 2026 variants are not subtle, and the installer they leave behind is one of two known families, but the second-stage payload, which often enables RDP or installs a hidden crypto miner, is what you cannot see.

How to stop the next one, and the one after that

The single most useful habit is to never allow a website to send you notifications unless you typed the address yourself and you actually want them. The 'Allow notifications' box is the one that converts a one-time scare into a daily nuisance, because once a site has the permission, it can pop up at you on the lock screen, at 2am, on payday, with a fresh new domain and a fresh new lie. The default in every modern browser is to ask first, and the answer to the question, for almost every site on earth, is no.

The second habit is to keep your browser updated. The October 2026 variants rely on a particular behaviour in the Fullscreen API that was tightened in Chrome 132 and Safari 18, both of which now require an explicit user gesture before a page can take over the screen. If you are on an older build, an unpatched Chromium fork, or one of the regional browsers that ships with cheap Android tablets, you are a soft target. Update the browser, or switch to a maintained one, and the trap loses half its bite.

The third habit is to treat every unsolicited alert on your screen as a webpage, because that is what it is. Real warnings from Windows, Mac, iPhone, and Android do not pop up in a browser tab, do not ask you to call a phone number, and do not demand gift cards. If you ever see those three things together, you are looking at a webpage pretending to be your operating system, and the only correct response is the same one you'd give to a stranger at the door: not today, and not through that lock.

This is general safety information, not legal advice. Scams change. If you need an official desk: FTC ReportFraud or IC3.