Chromium Security Checks for Downloaded Executable Files

Chromium employs a multi-layered security architecture to protect users from malicious executable files before they can be launched. This article provides an overview of the specific security checks the browser performs on downloaded executables, detailing the journey of a file from initial URL verification and binary inspection to Safe Browsing cloud analysis and operating system antivirus integration.

1. URL and Domain Reputation Checks

Before an executable file even finishes downloading, Chromium evaluates its source. The browser checks the final download URL, along with every URL in the redirect chain and the referring page, against the local Google Safe Browsing database. If any of these addresses match a known malware distribution site or phishing domain, Chromium immediately blocks the download.

2. File Type Danger Classification

Chromium maintains a strict internal list of file extensions to determine how different files should be handled. When a download begins, Chromium inspects the file extension (such as .exe, .msi, .bat, .dmg, or .apk) and assigns it a specific "danger level."

  • Allow: The file is considered safe and downloads normally.
  • Allow on User Gesture: The file is only downloaded without a warning if the user explicitly clicked a download link.
  • Dangerous: The file is inherently risky. Chromium pauses the completion of the download and forces the user to manually click "Keep" in the downloads bar or menu before the file is finalized on the hard drive.

3. Temporary Storage and Sandboxed Inspection

While a file is downloading, Chromium does not save it with its actual executable extension. Instead, it saves the data as a temporary, non-executable .crdownload file. This prevents the user or another program from accidentally running the file before security checks are complete.

Once the download finishes, Chromium uses a heavily restricted, sandboxed utility process to safely inspect the .crdownload file. This process extracts critical features without running the code, including:

  • The SHA-256 cryptographic hash of the file.
  • Digital signatures and certificate chains (such as Windows Authenticode or macOS code signing).
  • Structural metadata, such as Portable Executable (PE) headers in Windows files or Mach-O headers in macOS files.

4. Safe Browsing Application Reputation Query

If the downloaded executable is not caught by local blocklists, Chromium sends a ping to the remote Safe Browsing Application Reputation service. This ping includes the file's SHA-256 hash, extracted metadata, digital signature information, and the source URL.

The remote server analyzes this data and returns a verdict to the browser:

  • Safe: The file is a known, benign program (often signed by a trusted publisher).
  • Malicious: The file matches known malware, and Chromium blocks it.
  • Uncommon: The file is not recognized by Safe Browsing. Because malware is frequently mutated to evade detection, Chromium treats unknown executables with suspicion and displays a warning stating the file "is not commonly downloaded and may be dangerous."
  • Potentially Unwanted Program (PUP): The file may contain adware or change browser settings without clear consent, triggering a specific warning.

5. Deep Scanning for Enhanced Protection

If the user has opted into "Enhanced Protection" within Chromium's Safe Browsing settings, the browser can perform an additional check for unverified or suspicious executables. Chromium will prompt the user to send the actual file to Google Safe Browsing for a "deep scan." This uploads the executable to a cloud environment where it undergoes real-time static and dynamic analysis to detect zero-day threats before the user is encouraged to open it.

6. Applying the Mark-of-the-Web (MotW)

If the file passes the browser's internal checks—or if the user explicitly chooses to bypass the warnings—Chromium renames the .crdownload file to its final executable name. At this exact moment, Chromium stamps the file with metadata that tells the operating system the file originated from the internet.

  • On Windows: Chromium writes an Alternate Data Stream (ADS) named Zone.Identifier to the file, commonly known as the Mark-of-the-Web (MotW). This includes the security zone (Internet) and the exact download URL.
  • On macOS: Chromium applies the com.apple.quarantine extended attribute to the file.

7. Operating System Antivirus Hand-off

The final check occurs right before the file is released to the user. Chromium invokes the host operating system's native security interfaces to trigger a local antivirus scan.

On Windows, Chromium calls the IAttachmentExecute::Save API. This action automatically alerts Windows Defender (or any registered third-party antivirus software) to scan the newly created executable. Furthermore, because Chromium applied the Mark-of-the-Web, when the user finally clicks to open the file, the operating system will perform its own gatekeeping checks—such as Microsoft Defender SmartScreen or macOS Gatekeeper—providing one last barrier against malicious code execution.