Google Adds Ability to Scan Password-Protected Archives on Chrome

Google has announced significant improvements to the security features of Chrome's redesigned downloads experience, aiming to provide users with more detailed warnings and enhanced protections against malicious files.

A highlight of this update is the ability to warn the user about suspicious archive files, even if those are password-protected. As this is a common channel of malware distribution, the addition of this capability to Chrome, the world's most widely-used web browser, is posed to have significant impact on people's security.

Chrome's new download warnings

One of the key updates involves replacing the previous space-constrained warning messages with more detailed ones. The new warnings offer better context about the potential danger of a file, helping users make more informed decisions. Chrome now uses a two-tier download warning system based on AI-powered malware verdicts from Google Safe Browsing:

• Suspicious files: Indicating a lower confidence verdict with an unknown risk of user harm.
• Dangerous files: Indicating a high confidence verdict with a high risk of user harm.

These warnings are distinguished by distinct iconography, color, and text to ensure users can quickly and confidently assess the risk level. This improvement has led to fewer warnings being bypassed and a quicker user response to potential threats, resulting in better protection against malicious downloads.

Automatic deep scans

For users who have opted into the Enhanced Protection mode of Safe Browsing in Chrome, Google has introduced automatic deep scans for suspicious files. These scans, which occur before a file is opened, have proven effective in catching new malware and dangerous files hosted on new sites. The results have been significant, with files sent for deep scanning being over 50 times more likely to be flagged as malware compared to general downloads.

Enhanced Protection users have previously agreed to send a fraction of their downloads to Safe Browsing for these additional scans, and the shift to automatic deep scans aims to reduce user friction while maintaining robust security.

Encrypted archive scans

Google has also targeted a growing trend in malware distribution involving encrypted archives such as .zip, .7z, or .rar files. These files often evade detection due to password protection. To combat this, Chrome introduces new mechanisms depending on the user's Safe Browsing mode:

• Enhanced Protection Mode: Users downloading suspicious encrypted archives will be prompted to enter the file's password, which is sent along with the file to Safe Browsing for a deep scan. The files and passwords are deleted shortly after the scan.
• Standard Protection Mode: Users will also be prompted to enter the file's password, but the file and password stay on the local device, with only the metadata checked against Safe Browsing's database.

These measures ensure a higher level of protection for all users, with Enhanced Protection offering a more thorough scan while Standard Protection checks against known threats.

Chrome's security team says it will continue to collaborate with Google's Threat Analysis Group (TAG) to respond quickly to new strategies and evolving threats.