Posted by Joe DeBlasio, Chrome security team

Update (04/06/2020): Chrome was originally scheduled to start user-visible warnings on mixed downloads in Chrome 82. These warnings, as well as subsequent blocking, will be delayed by at least two releases. Console warnings on mixed downloads will begin as scheduled in Chrome 81.

At this time, we expect to start user-visible warnings in Chrome 84. The Chrome Platform Status entry will be kept up-to-date as timing is finalized. Developers who are otherwise able to do so are encouraged to transition to secure downloads as soon as possible to avoid future disruption.

Today we’re announcing that Chrome will gradually ensure that secure (HTTPS) pages only download secure files. In a series of steps outlined below, we’ll start blocking “mixed content downloads” (non-HTTPS downloads started on secure pages). This move follows a plan we announced last year to start blocking all insecure subresources on secure pages.
Insecurely-downloaded files are a risk to users’ security and privacy. For instance, insecurely-downloaded programs can be swapped out for malware by attackers, and eavesdroppers can read users’ insecurely-downloaded bank statements. To address these risks, we plan to eventually remove support for insecure downloads in Chrome.
As a first step, we are focusing on insecure downloads started on secure pages. These cases are especially concerning because Chrome currently gives no indication to the user that their privacy and security are at risk.
Starting in Chrome 82 (to be released April 2020), Chrome will gradually start warning on, and later blocking, these mixed content downloads. File types that pose the most risk to users (e.g., executables) will be impacted first, with subsequent releases covering more file types. This gradual rollout is designed to mitigate the worst risks quickly, provide developers an opportunity to update sites, and minimize how many warnings Chrome users have to see.
We plan to roll out restrictions on mixed content downloads on desktop platforms (Windows, macOS, Chrome OS and Linux) first. Our plan for desktop platforms is as follows:

• In Chrome 81 (released March 2020) and later:
  • Chrome will print a console message warning about all mixed content downloads.
• In Chrome 82 (released April 2020):
  • Chrome will warn on mixed content downloads of executables (e.g. .exe).
• In Chrome 83 (released June 2020):
  • Chrome will block mixed content executables
  • Chrome will warn on mixed content archives (.zip) and disk images (.iso).
• In Chrome 84 (released August 2020):
  • Chrome will block mixed content executables, archives and disk images
  • Chrome will warn on all other mixed content downloads except image, audio, video and text formats.
• In Chrome 85 (released September 2020):
  • Chrome will warn on mixed content downloads of images, audio, video, and text
  • Chrome will block all other mixed content downloads
• In Chrome 86 (released October 2020) and beyond, Chrome will block all mixed content downloads.

Read More