Google may refuse a sign-in environment it does not consider suitable, even when the password is correct. A “browser or app may not be secure” message should lead you to a supported sign-in path, not to disabling account protection.
Use a current standalone browser
Open the service in a current supported browser, such as Chrome, Safari, Firefox, or Edge, and begin its legitimate sign-in flow. Google identifies embedded browsers, unsupported extensions, disabled JavaScript, and software-controlled browsing among the environments it may reject.
If the error appears inside an app, look for the app’s documented option to open authentication in the system browser. Update the app through its official distribution channel. A password change will not fix an app that implements an unsupported sign-in method.
Check the browser without weakening the account
- Install available browser updates.
- Confirm JavaScript is allowed for the legitimate sign-in.
- Review extensions, particularly those recently installed or no longer supported.
- Test a clean supported browser context if needed.
Keep 2-Step Verification enabled. Do not seek an old “less secure apps” switch, paste authentication tokens into a helper site, or install an unknown extension promising to bypass Google’s check.
For work and school devices
Provide the administrator with the app name, browser version, and exact error. Google specifically directs managed-device users to their administrator for security-setting issues.
Do not bypass certificate warnings or disable endpoint protection to make the flow succeed. If a proxy or security product is involved, its configuration should be reviewed through the organization’s supported process.
If you maintain the affected app
Google’s developer guidance points away from embedded authentication toward a supported browser-based OAuth flow. A developer must repair the integration; end users should not be asked to surrender their Google password directly to the application.
Once the legitimate sign-in succeeds, confirm that it opens the expected existing account and data. Authentication success alone does not prove that a third-party app linked the correct customer profile.
Official references
Reviewed against Google’s official guidance on October 27, 2026. Available options and screen labels can vary by account, device, region, and organization policy.