Loading story…
Google announced that starting with Chrome version 154, the browser will default to using secure HTTPS connections for all public websites, warning users before they access any site that does not support HTTPS. This change is part of the new 'Always Use Secure Connections' feature, which aims to make secure browsing the standard and will require user approval before opening insecure HTTP sites. Internal addresses such as routers, intranets, and servers will be exempt from these warnings due to their lower risk profile.
The rollout will begin in April 2026 with Chrome 147 for Enhanced Safe Browsing users and expand globally in October 2026. Google cited the significant increase in HTTPS adoption, from 30-45% of Chrome traffic in 2015 to 95-99% by 2020, as a key factor enabling this shift. Early testing indicated that fewer than 3% of visits triggered warnings, suggesting most sites are already compliant. Google plans to further reduce barriers to HTTPS adoption, especially for local network sites, to enhance user security against potential attackers exploiting insecure connections.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Reports said Google plans to automatically block unsecured sites in Chrome starting in 2026, expanding enforcement beyond warnings for HTTP pages. This reflects a broader move to phase out insecure web connections in the browser.
Google said Chrome 154 will default to the 'Always Use Secure Connections' setting, warning users before they visit insecure HTTP sites. The change was reported as a major browser security shift affecting how Chrome handles non-HTTPS connections.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google announced that starting with Chrome version 154, scheduled for release in October 2026, the browser will by default warn users before connecting to public websites that do not use HTTPS. This change will enable the 'Always Use Secure Connections' setting for all users, requiring explicit user permission before accessing any public site over unencrypted HTTP. The move aims to protect users from man-in-the-middle attacks, data interception, and other risks associated with insecure HTTP connections. Chrome will display warnings primarily when users attempt to visit new or rarely accessed sites that lack HTTPS, rather than repeatedly alerting users for frequently visited insecure sites. This update builds on Chrome's existing HTTPS-First Mode, which has been available as an opt-in feature since 2021. Users will also have the flexibility to enable insecure connection alerts for both public and private sites, including enterprise intranets. The initiative is part of a broader industry push to promote secure web browsing and raise awareness about the importance of HTTPS, as highlighted during Cybersecurity Awareness Month. Security education efforts, such as those by ManageEngine, continue to emphasize the critical role of HTTPS in protecting user data and preventing exploitation by attackers.
Jun 29, 2026
Google released **Chrome 152** to the stable channel for Android, ChromeOS, Linux, macOS, and Windows, adding Connection Allowlists, the CPU Performance API, and a bypassable suspicious-site warning for Safe Browsing Enhanced Protection users. The warning appears when Chrome detects signals that a visited site may be malicious, while the release also expands support for `CSSPseudoElement` APIs and introduces web-platform, PWA, networking, media, and WebGPU changes. Connection Allowlists let sites use the `Connection-Allowlist` HTTP response header to restrict the URL patterns that documents and web workers can contact. Chrome blocks non-allowlisted subresource requests, redirects, WebSocket connections, and other covered network activity at the network layer, limiting data-exfiltration opportunities from compromised third-party scripts, vulnerable dependencies, and untrusted generated code. The control complements, rather than replaces, Content Security Policy; it follows an origin trial that initially covered document contexts and did not support dedicated, shared, or service workers.
Aug 26, 2026
Google has introduced new layered security defenses in Chrome to address the growing risks of indirect prompt injection attacks and account takeovers, particularly as the browser integrates more agentic AI capabilities. Key features include the User Alignment Critic, which independently evaluates and vetoes potentially malicious actions by Chrome's AI agent, and Agent Origin Sets, which restrict the agent's data access to only relevant or user-approved sources. These measures are designed to prevent attackers from exploiting untrusted web content to hijack user sessions or exfiltrate sensitive data, and to mitigate site isolation bypasses that could compromise user privacy and security. In parallel, Google has acknowledged a surge in account takeover incidents targeting Chrome users, where attackers steal credentials, authentication codes, and session cookies to access synchronized data stored in the cloud. The company is urging users to strengthen their authentication methods and reconsider the use of browser-based password managers, as a single compromised account can expose a wide range of personal information. Google is also rolling out additional protections for Workspace accounts to counteract these threats and safeguard user data across its ecosystem.
Jun 29, 2026