Google Chrome for Android gets HTTPS-only mode, site isolation and JS controls

Google has introduced new Chrome features tied to its Android Advanced Protection program, aimed at users requiring heightened security such as journalists, public figures, and elected officials. This device-level security setting activates Google’s strongest protections across key applications, including Chrome.

Key Chrome Integrations with Android Advanced Protection:

Always Use Secure Connections

This setting enforces HTTPS connections whenever possible, protecting users from attackers intercepting or altering data on insecure HTTP sites. It prompts users before connecting insecurely, reducing risks on public and private networks alike.

• Less than 1% of Chrome Android page loads use HTTP, and Google plans to make HTTPS-first mode default for all users.
• Variants exist that warn only on public sites but allow local network exceptions (e.g., internal IPs).
• Automatically enabled in Incognito Mode for public sites since June 2024 and prevents HTTPS-to-HTTP downgrades on known HTTPS sites since January 2025.
• All users and enterprises can enable and customize this setting with policies and allowlists.

Full Site Isolation on Mobile (4GB+ RAM)

For eligible Android devices, Chrome separates websites into different processes, blocking malicious sites from accessing data from other pages.

• Desktop Chrome has had full Site Isolation by default.
• On Android, Advanced Protection enables this for all sites on devices with 4GB+ RAM, improving protection against cross-site attacks.

If Advanced Protection isn’t enabled, Chrome only isolates a site after you log in or submit a form there.

JavaScript Optimizations and Security

Advanced Protection disables V8’s high-level JavaScript optimizing compilers, reducing Chrome’s attack surface by blocking a class of known exploits at some performance cost.

• This option is available to all users via the new Chrome Site Setting for JavaScript optimization, allowing per-site control.
• Enterprises can manage it via policies to allowlist trusted sites while blocking optimizers elsewhere.
• Ongoing efforts include rolling out a V8 sandbox to strengthen security further.

Why It Matters

Google points out that Chrome and Android support billions of users with varying security needs. The Advanced Protection tools allow customization of security settings for both individuals and enterprises, balancing protection and usability.

For those at higher risk, Google recommends enabling these settings and joining the Advanced Protection Program, which includes phishing-resistant MFA and device protections.

Availability

Advanced Protection is now available on Android 16 with Chrome 137+.