Google to protect users from “drive-by” downloads in Chrome 73

Drive-by downloads are often malicious, commonly coming in the form of hidden iframes that activate without a click from the user. Such iframes are common on hacked websites, but Google plans to address this issue by preventing downloads from sandboxed iframes that lack user gestures. 

Chrome version 73 is due to release on March or April, with the feature coming to all version of Chrome except for its iOS variant, which doesn’t use the Chromium web engine. Google estimates that 0.002117% of all web pages loaded on Chrome contain drive-by downloads. While this is a tiny percentage, it is worth remembering how vast the internet is, and the sheer number of pages “drive-by” downloads are present on.     

Sadly, this protection is not expected to completely mitigate the problems posed by drive-by downloads, as Google plans to offer an iframe attribute that disables the browser’s security. This means that hackers that have compromised a website’s source code could use this attribute to disable Google’s download protection. Even so, Google’s planned feature will protect a lot of users from potential online attacks.