Chrome Requires User Permission for Insecure HTTP Connections
Google Chrome now blocks plain‑HTTP requests by default and asks users to approve them, reducing exposure to man‑in‑the‑middle attacks. This change provides measurable evidence for control‑assurance programs.
ADTP Breach Watch· October 21, 2026· Help Net Security
SeverityInformational
Type🤖 Advisory
ConfidenceHigh
ReportedOct 21, 2026
Technology & SaaSTECH_SAASUnknown
What happened
Chrome introduced a default setting that intercepts HTTP requests and displays a permission prompt the first time a user visits an insecure site. The decision is cached for two weeks, and local hostnames or private IP addresses are exempt.
Why it matters for trust and compliance
The feature enforces the control objective of secure communications, giving organizations verifiable logs that support continuous monitoring and audit readiness.
Provides automatic evidence of transport‑encryption enforcement for control monitoring.
Reduces reliance on user vigilance alone by embedding a prompt that can be tracked and reported.
Who is affected
TECH_SAAS
Recommended actions
Audit internal web services for HTTPS compliance and enable HSTS.
Collect Chrome prompt logs as evidence of secure‑connection controls.
Update user security awareness training to cover the new permission prompt.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.