Google engineers have started working on adding drive-by download protection in Chromium, the open-source browser engine that Chrome is based on.
The feature is already active in the current Chrome Canary edition and is scheduled to land in the stable version, in Chrome 73, scheduled for release in March or April.
For ZDNet's non-technical users, "drive-by download" is a term used in the information security (infosec) industry to describe a download that happens without the user's knowledge.
Not all drive-by downloads are considered malicious, as some URLs are meant to trigger a file download when accessed.
However, when a download is triggered on a web page from an iframe element hidden in its code, those types of downloads are almost always malicious in nature.
These usually happen when iframe elements showing ads contain malicious code that trigger the drive-by download, or when users access a hacked site where hackers left a hidden iframe to infect visiting users.
"We plan to prevent downloads in sandboxed iframes that lack a user gesture, and this restriction could be lifted via an 'allow-downloads-without-user-activation' keyword, if present in the sandbox attribute list," Google said in a public document containing its feature implementation plan that it released earlier this week.
- Google may break ad blockers with upcoming Chrome change (CNET)
- Photos: 10 years of Google Chrome (TechRepublic)
Google intends to add drive-by download protection to all Chrome versions, except the one that ships for iOS, which isn't based on the Chromium engine, but on WebKit (Safari's engine), where this type of protection isn't yet supported.
Because this is a pretty useful security feature, other browsers based on Chromium --such as Opera, Vivaldi, Brave, and soon Microsoft Edge-- are also expected to deploy it as well.
In the long run, this feature is expected to thwart quite a few malvertising campaigns --criminal groups that hide malicious code inside ads to drop malware-laced files on users' computers.
The feature isn't expected to stop drive-by download attacks part of "watering hole attacks," a term used to describe when hackers compromise a website and leave a hidden iframe behind to trigger the drive-by download. This is because hackers already have access to a compromised site's source code, and they can just use the iframe attribute that Google engineers plan to add to instruct Chrome to disable the drive-by download protection when rendering those iframes.
- Google Chrome's new UI is ugly, and people are very angry
- Best Google Chrome extensions for productivity, security
- Chrome API update will kill a bunch of other extensions
More browser coverage:
- How to enable and test the new Google Chrome dark mode on Windows 10
- Firefox to remove misleading button after months of complaints
- Google Chrome extension that steals card numbers still available on Web Store
- Google Chrome's built-in ad blocker to roll out worldwide on July 9
- Firefox will finally fix annoying page jumps
- Chrome API update will kill a bunch of other extensions, not just ad blockers
- Brave is the default browser on obscure HTC crypto-phone CNET
- Mozilla and Qualcomm unveil native ARM64 Firefox version for Windows 10 TechRepublic