Google revealed a new plan, initially to warn Chrome users about “insecure” downloads and eventually block them directly.
“Today we announce that Chrome will gradually ensure that secure pages (HTTPS) only download safe files,” Joe DeBlasio of the Chrome security team wrote in a blog post .
“Files that are downloaded instantly pose a risk to the security and privacy of users. For example, programs that are downloaded insecure can be exchanged for malware by attackers, and eavesdroppers can read bank statements that are downloaded insecure by users. ”
Starting with Chrome 82, to be released in April, Chrome will warn users if they will download mixed content executable from secure websites.
Then, when version 83 is released, executable downloads will be blocked and a warning will be applied to the archive file.
PDF and .doc files will get a warning in Chrome 84, with audio, image, text and video files displaying them based on version 85.
Finally, all downloads of mixed content (insecure files originating from secure sites) will be blocked in the Chrome 86 release.
Currently, Google expects an October release to build popular web browsing. The chart below outlines the current Chrome team plan:
“In the future, we hope to further limit unsafe downloads in Chrome,” wrote DeBlasio.
This is all part of Google’s efforts to fully migrate developers to HTTPS. Last year, Google began blocking HTTPS sites from pulling insecure page resources.
This warning also comes to Chrome on Android and iOS versions, but the above schedule will be delayed by a release for the mobile platform.
Chrome will delay the launch for Android and iOS users with one release, starting a warning in Chrome 83.
The mobile platform has better native protection against malicious files, and this delay will give developers an initial step to update their site before it impacts mobile users.