Skip to content

Google Chrome Puts Measures to Protect Users from Insecure Downloads

On February 6, 2020, Google announced that Chrome would gradually certify that secure (HTTPS) pages only download safe files. The platform started blocking “mixed content downloads” (non-HTTPS downloads started on secure pages) using a series of steps that it outlined.

The cybersecurity move follows a plan highlighted in October 2019 to begin blocking all the insecure sub-resources on secure pages. Insecurely-downloaded files present major risks to users’ privacy and security.

For example, insecurely-downloaded programs can be substituted with malware by attackers. Moreover, the eavesdroppers can read the unsuspecting users’ insecurely-downloaded bank statements.

To solve these challenges, Google plans to eliminate support for insecure downloads in Chrome. The first step is to remove the insecure downloads started on secure pages since these cases affect unsuspecting Chrome users whose privacy and security are at risk.

Chrome will start warning on and later blocking the mixed content downloads beginning with Chrome 82 that will be released in April 2020. All the files that pose the most risks will be targeted first, and the subsequent releases will cover more file types

Image by Joe DeBlasio, Chrome security team.

The continuous rollout is set up to neutralize the worst risks rapidly, enabling developers to update sites and reduce the number of warnings that Chrome users have to see.

Google plans to roll out restrictions on mixed content downloads on desktop platforms first, which include Chrome OS, Windows, Linux, and macOS.


Chrome announced that it would delay the rollout for iOS and Android users by one release. They will start the warnings in Chrome 83. Mobile platforms have enhanced native protections against malicious files.

Hence, the delay will enable developers to prepare adequately while updating their sites before focusing on mobile users.

Developers aim to ensure that the users do not see any download warnings. They will achieve that by ensuring downloads only use HTTPS.

In the Chrome Canary or Chrome 81, once released, developers can activate a warning on all the mixed content downloads for testing by activating the “Treat risky downloads over insecure connections as active mixed content” flag.

Education and enterprise customers can disable the block on a per-site basis via the existing InsecureContentAllowedForUrls policy. They will do so by adding a pattern that matches the page requesting the download.

It is expected that a further restriction of insecure downloads in Chrome will be implemented in the future. Developers should migrate to HTTPS entirely to avoid any future restrictions and guarantee that they protect their users entirely.

Best Crypto Exchange for Intermediate Traders and Investors

  • Invest in 70+ cryptocurrencies and 3,000+ other assets including stocks and precious metals.

  • 0% commission on stocks - buy in bulk or just a fraction from as little as $10. Other fees apply. For more information, visit

  • Copy top-performing traders in real time, automatically.

  • eToro USA is registered with FINRA for securities trading.

30+ million Users
eToro is a multi-asset investment platform. The value of your investments may go up or down. Your capital is at risk. eToro USA LLC does not offer CFDs, only real Crypto assets available. Don’t invest unless you’re prepared to lose all the money you invest.

Read Next:

Weekly Finance Digest

By subscribing you agree with Finbold T&C’s & Privacy Policy

Related posts

Disclaimer: The information on this website is for general informational and educational purposes only and does not constitute financial, legal, tax, or investment advice. This site does not make any financial promotions, and all content is strictly informational. By using this site, you agree to our full disclaimer and terms of use. For more information, please read our complete Global Disclaimer.