In short:
Nothing to worry about, unless you have downloaded an app suggested by the pop-up.
In More detail:
It's an old issue. You visit a normal website, and suddenly you see pop-ups telling you that your phone has a virus.
It's called scareware. It's basically "ads" which scare you into downloading their "anti-virus" apps. Many times, the apps you will download are the ones with malware.
Why they show up:
When you see it on big websites like New York Times, it's not because the website is intentionally sending these ads; rather, it's because the innocent looking ads that the website is selling space to are laden with hidden code, which then allows them to display scareware without the website publisher knowing about it.
Many social media posts lamented that even top-tier publishers like
The New York Times and The Atlantic were willing to run such intrusive
ads on their sites. But experts say the problem isn’t with lack of
discernment on the part of site publishers but with an extremely
complex online advertising system that makes it hard for publishers
involved to detect, let alone weed out, misleading and malware-laden
ads. Source
Every website you visit is able to tell what phone you are using. This info is sent to the website by your browser. The scareware ads then use that info to make their warning look more real and scary.
You can even have a look at this website using your browser, it will tell you exactly what phone and Android version you're using.
What to do:
There is nothing to worry about, as the websites you visit have no way of knowing if you have a "virus" and therefore, the info cannot possibly be true.
When you get such a warning, simply close your browser. You can also clear the cache just in case (settings → apps → [browser name] → storage → clear cache).
If you do download the advertised app, make sure to uninstall it, or even factory reset your phone.
the Good news:
There's a simple way to disable these popups as explained by Android Police:
If you want to manually turn on the feature, and deal with whatever
lingering bugs it currently has, it's pretty simple. Just copy
chrome://flags/#enable-framebusting-needs-sameorigin-or-usergesture
and paste it in the address bar (you can't tap on that link directly).
Then tap the highlighted dropdown menu, change it to 'Enabled,' and
restart the browser when asked
