Severity rationale: While not a vulnerability itself, this is a major breaking change that will impact user access to insecure sites; the 'suspected' exploitation status refers to the active use of HTTP hijacking by threat actors which this change aims to mitigate.
Google Chrome to Enforce HTTPS by Default for Public Sites by October 2026
Google · Chrome Browser
Google Chrome will begin mandating secure HTTPS connections by default in October 2026. This change will introduce browser warnings for users visiting any public website that lacks encryption. Leaders should ensure all public-facing digital assets are migrated to HTTPS within the next 12 months to avoid service disruption and user distrust.
Key Facts
- Vendor
- Product
- Chrome Browser
- Exploitation
- Suspected exploitation
- Affected versions
- Google Chrome versions prior to 154
- Fixed versions
- Chrome 147 (partial), Chrome 154 (full)
Summary
Google has announced its roadmap to make HTTPS the default connection protocol in Chrome by October 2026. With the release of Chrome 154, the "Always Use Secure Connections" setting will be enabled by default for all users. This change will trigger a browser warning if a user attempts to access a public website that does not support HTTPS.
What happened
Google is moving Chrome from a "passive" HTTPS posture (showing a 'Not Secure' badge) to an "active" one (intercepting navigations with a warning). This transition addresses a security plateau where approximately 5-10% of navigations remain insecure. Attackers commonly exploit these remaining HTTP connections to hijack navigations, inject malware, or conduct social engineering. Notably, many current HTTP connections are "invisible" to users because they exist only briefly as a redirect to an HTTPS site, providing an unmonitored window for interception.
Why it matters
Even a single insecure HTTP navigation can serve as an initial foothold for an attacker. By enforcing HTTPS by default, Google aim to eliminate the possibility of transparent man-in-the-middle (MiTM) attacks on public sites. For security operations, this reduces the attack surface for credential theft and browser-based exploits. For organizations, it introduces a hard deadline to migrate any remaining public-facing legacy HTTP services to TLS before Chrome begins blocking them with high-friction user warnings.
Affected systems
- Google Chrome: Users on all platforms (Windows, macOS, Linux, Android, iOS).
- Public Web Infrastructure: Any website accessible via public DNS that has not yet implemented HTTPS.
- Legacy Enterprise Apps: Publicly routed internal tools that rely on HTTP for simplicity or legacy compatibility.
Recommended actions
- Inventory Public Sites: Audit all public-facing domains and subdomains to ensure valid TLS certificates are in place and HTTP-to-HTTPS redirects are configured.
- Enable Early Testing: Administrators should enable the "Always Use Secure Connections" flag (
chrome://settings/security) for a subset of users today to identify potential workflow breakages. - Review Local Network Access: For internal services that cannot use TLS, investigate the new "Local Network Access" permission in Chrome to allow secure origins to communicate with local HTTP resources without mixed-content blocking.
- Enterprise Policy: IT managers should review Chrome Enterprise policies to manage how these warnings are displayed to employees once the rollout begins in 2026.
Technical details
Chrome is transitioning from an 'opt-in' to an 'opt-out' model for HTTPS enforcement. Currently, Chrome warns on HTTP via a small 'Not Secure' icon. The new default will upgrade all 'http://' navigations to 'https://' automatically. If the secure handshake fails, the browser will present a full-page interstitial warning before allowing the user to proceed to the insecure site. This process protects against SSL stripping attacks and ensures that redirections from HTTP to HTTPS are not intercepted in transit.
Detection & hunting
Log analysis of web server traffic should look for inbound 'GET' requests on port 80. Security teams can use browser telemetry or web proxy logs to identify 'public' destinations that lack an 'https://' prefix. Monitoring for 'ERR_SSL_PROTOCOL_ERROR' or bypass events in Chrome enterprise logs will help identify problematic sites during the 2026 transition.
Recommended actions
Immediate Containment & Testing
- Enable 'Always Use Secure Connections' on IT/Security workstations today for compatibility testing.
Patch & Verify
- Inventory all public-facing domains and ensure HTTPS is configured.
- Migrate legacy HTTP-only public redirects to HTTPS.
Harden
- Utilize Chrome Enterprise policies to manage warning behavior for managed devices.
- Implement Local Network Access permissions for necessary internal HTTP communications.
Monitor
- Monitor web server logs for HTTP (Port 80) traffic to identify un-migrated assets.
Compliance relevance
Sources
- HTTPS by default · Google Security Blog
- infosecurity-magazine.com · InfosecurityMagazine
Disclaimer: CyberBrief HQ articles are for informational purposes only and do not constitute security advice for any specific environment. Always validate guidance against your own controls and vendor advisories before acting.