v152 · safety · safe browsing

A warning your site cannot see

For users on Enhanced protection, Chrome 152 shows a dismissible warning over sites carrying signals of being malicious — softer than the red interstitial, and shown in cases that would not have earned one. There is no API here: your site is not told, cannot ask, and cannot opt out. What it can do is understand which signals it is emitting.

concepts

  1. What a page can observe

    Nothing — and proving that properly is the demo. Every plausible API is probed, alongside the reporting mechanisms that are sometimes mistaken for this one.

  2. Audit your own markup

    A working checker for the patterns that make a page look deceptive: cross-origin form posts, password fields outside a secure context, link text that names a different domain, punycode hostnames, meta refresh chains. Runs over this page, or over markup you paste.

  3. If you are flagged

    The actual path back: which console to open, which status page to read, what a review needs. Type a domain and get the exact links, built from the real URL formats.

why it shipped

Safe Browsing's red interstitial is a strong claim and is used sparingly: the page is known to be dangerous. That leaves a large middle ground of sites with signals worth being wary about but not enough for a blocking verdict, and until now users saw nothing at all in that band.

A dismissible warning fits that middle: it interrupts, it explains, and it lets the user continue. It is shown only to people who opted into Enhanced protection, which is what makes the trade acceptable — a warning with more false positives is tolerable when the audience has asked for more caution.

there is no API

// None of this exists, and none of it is proposed:
navigator.safeBrowsing            // undefined
document.suspiciousSiteWarning    // undefined
new ReportingObserver(…)          // real, but reports YOUR policy violations

// What a site actually has:
//   Search Console — security issues, and a review request
//   Safe Browsing site status — the current verdict for a URL
//   Transparency Report — the same data, publicly

That is deliberate. A page that could detect the warning could work around it, and a page that could opt out would be exactly the page you would want warned about.

enabling it now

Nothing to enable, and nothing to flag. The warning is a browser behaviour for users on Enhanced protection on Android, shown at the browser's discretion — there is no switch a page can throw and no state a page can read. Measured on the build these pages were made with: every plausible detection API is absent, which the first demo shows one by one rather than asserting.

references