They are gradually eliminating mixed content downloads in future builds.Īn August 2020 build of Chrome blocked all downloads except images, audio, video, and text.

In the Chrome 82 build, Google added popup warnings to users if they initiated an insecure download on a secure site. Google is clearly aware of the mixed content download problem, but it’s arguably moving too slowly. Is Google Doing Enough to Prevent Mixed Content Downloads? Because ordinary users may not know exactly what HTTPS does, they never suspect that a website that uses the lock symbol might still be trying to phish their credentials or infect their computer. Increasingly, attackers are building phishing sites that make use of the HTTPS standard and then implementing mixed-resource downloads on their own. ( Read also: Cybersecurity and Infrastructure: Current Trends and Future Developments.) The major vulnerability is if a developer accidentally creates a resource for download that was already contaminated by malware (such as an infected PDF), or if an attacker obtains developer credentials and does the same thing.ĭeveloper error isn’t the primary place that you’ll see mixed-resource downloads anymore, however. If the mixed content download occurs via developer error, then the download itself may not present that much of a risk (relative to everything else on the internet, at least).

Google chrome insecure browser