<p>Recently, Google has involved itself in numerous privacy and security changes within Google Chrome. The most important of these was the emphasis on HTTPS for websites. Now, they have announced another strict move in this connection. Google intends to block HTTPS mixed content within their Chrome browser. </p>



<h2>Google To Block Mixed Content</h2>



<p>Reportedly, Google plans to block mixed content for HTTPS in the future. According to a recent <a href="https://security.googleblog.com/2019/10/no-more-mixed-messages-about-https_3.html" target="_blank" rel="noreferrer noopener" aria-label="blog post (opens in a new tab)">blog post</a> by the Chrome Security Team, Google will eventually block mixed content entirely within Chrome. This would ensure full HTTPS implementation only.</p>



<h2>What Is Mixed Content</h2>



<p>As explained separately, ‘<a rel="noreferrer noopener" aria-label="Mixed Content (opens in a new tab)" href="https://developers.google.com/web/fundamentals/security/prevent-mixed-content/what-is-mixed-content" target="_blank">Mixed Content</a>’ refers to the type of content on websites using HTTPS where certain elements on the web page load over HTTP.</p>



<blockquote class="wp-block-quote"><p>Mixed content occurs when initial HTML is loaded over a secure HTTPS connection, but other resources (such as images, videos, stylesheets, scripts) are loaded over an insecure HTTP connection. This is called mixed content because both HTTP and HTTPS content are being loaded to display the same page, and the initial request was secure over HTTPS. </p></blockquote>



<h2>How It Affects Browser Security</h2>



<p>Although, Chrome used to notify users about the presence of such content. It couldn’t protect the users from the potential evils of HTTP content on the web page. Thus, the existence of such content downgrades the extent of security as ensured with full HTTPS sites.</p>



<blockquote class="wp-block-quote"><p>Requesting subresources using the insecure HTTP protocol weakens the security of the entire page, as these requests are vulnerable to man-in-the-middle attacks, where an attacker eavesdrops on a network connection and views or modifies the communication between two parties.</p></blockquote>



<p>Eventually, the presence of such content could even allow an adversary to take complete control of the affected page. </p>



<p>Google explained that such content also affects the browser security UX. The browser could neither present it as HTTPS, nor HTTP. </p>



<h2>Implementation To Happen Gradually </h2>



<p>While Google has announced their plans to ensure no mixed content, it will do so in a number of different steps. Consequently, HTTPS websites with mixed content have enough time to modify the affected pages accordingly. </p>



<p>As per the disclosed timeline, initially, Google will roll out settings for users to unblock mixed content on sites. This will take place with Chrome 79 releasing in December 2019. </p>



<p>Then, with Chrome 80, Google will block audio/video resources that fail to load over HTTPS by default. Users would still be able to unblock the content via given settings. However, it will allow the mixed images, where the browser will prompt the site as ‘Not Secure’. </p>



<p>Finally, with Chrome 81 coming in February 2020, Google will block mixed images as well. </p>



<p>For convenience, Google has shared detailed guides for <a rel="noreferrer noopener" aria-label="migrating to HTTPS (opens in a new tab)" href="https://developers.google.com/web/fundamentals/security/encrypt-in-transit/enable-https" target="_blank">migrating to HTTPS</a> and <a href="https://developers.google.com/web/fundamentals/security/prevent-mixed-content/fixing-mixed-content" target="_blank" rel="noreferrer noopener" aria-label="preventing mixed content (opens in a new tab)">preventing mixed content</a> as well.</p>

Recently, Google has involved itself in numerous privacy and security changes within Google Chrome. The most important of these was the emphasis ...

Google Plans To Block Mixed Content With HTTPS On Chrome Browser