In recent days Google has revealed some important details about the roadmap that will mark the releases of the next versions of the broswer Chrome, and in particular on the new reporting methods (and blocking) that it will operate towards unsafe downloads starting from HTTPS web pages.
"We announce that Chrome will gradually ensure that only secure files can be downloaded from HTTPS secure pages. Files downloaded in an unsafe manner are a risk to the safety and privacy of users. For example, programs downloaded in an unsafe manner can be replaced with malware from attackers, while attackers could intercept bank statements downloaded in an unsafe manner, "explained Chrome's security officer, Joe DeBlasio, in a post on the official blog. Chrome speaks of "mixed content" or "unsafe" elements, ie deriving from non-HTTPS sites within HTTPS sites.
Graduality is precisely the key feature of the release plan that Chrome has in mind: starting from version 82, which is slated for April, the browser will warn users if they are going to download unsafe executables from an HTTPS website.
As can be seen from the diagram published on the blog, with the release of version 83 the executables will instead be blocked directly, while the warning will concern the archives. And so on with this cadence: in Chrome 84 the warnings will be for the .doc and .pdf documents, while the archives will be blocked, it will then be the turn of the warnings for audio files, images and videos in version 85 and finally from version 86 Chrome will directly block all unsafe downloads within an HTTPS site. According to Google, the Chrome 86 version will be released approximately during the month of October.
The strategy will also be pursued for versions Android and iOS of Chrome, but the roadmap will be delayed by one version. DeBlasio points out: "Chrome will postpone the rollout for Android and iOS, by starting the alerts from Chrome 83. Mobile platforms have better native protection against dangerous files, and this will give developers a little advantage in updating their sites before impact mobile users. "