-5.png?w=1024)
Chrome's Incognito mode may keep your browsing history off your device, but it could also be slower to recognize newly discovered malicious websites.
Google is developing a change that would extend real-time Safe Browsing checks to Chrome's Incognito and Guest modes, potentially closing a gap between private sessions and regular browsing.
The distinction matters because malicious websites can appear and disappear faster than traditional threat lists are updated. According to reporting cited by Digital Trends, Google says most malicious websites remain active for less than 10 minutes, while locally stored threat lists can take 30 to 60 minutes to refresh.
Windows Report, which first spotted and reported the change, says that Google wants to bring real-time Safe Browsing checks to these private sessions without undermining the privacy protections that make them appealing in the first place.
The proposed change is still under development, and its availability arrangements remain unknown.
Incognito has a security loophole, and Chrome is fixing it
In the report from Windows Report, the publication cited a Chromium development note suggesting that Google is working to bring real-time Safe Browsing protection to Chrome's Incognito and Guest modes.
It's a welcome change, especially since users may assume that browsing privately or separately from their main Chrome profile also means stronger security protections.
For context, Incognito lets users browse without Chrome retaining their browsing history, cookies, and site data after the private session ends. Guest mode, on the other hand, is similar but built for a different situation: it offers a separate browsing environment without giving visitors access to the primary user's Chrome profile.
Both are useful privacy features, but as we are seeing now, neither guarantees better security against malicious websites than conventional browsing.
But Chrome's current implementation can leave them relying on locally stored lists of malicious websites rather than more current threat information, potentially allowing newly identified phishing and malware sites to slip through.
How do the protections really work?
First, it helps to understand that Chrome's Safe Browsing doesn't offer just one level of protection. Google provides two options: Standard Protection and Enhanced Protection, with the latter offering additional checks and a more proactive approach to identifying threats.
Here's how they differ:
| Features | Standard Protection | Enhanced Protection |
|---|---|---|
| Known malicious websites | Checks websites against known threat information. | Checks for known threats and offers additional protection against emerging ones. |
| Phishing and malware | Warns users about known dangerous websites and downloads. | Provides more proactive detection of suspicious websites, downloads, and extensions. |
| Information shared | Uses privacy-preserving checks to limit the information Google receives. | Shares more security-related information with Google, including URLs, downloads, and samples of suspicious content |
| Protection level | Google's default protection setting. | Google's more comprehensive protection option. |
The important distinction is that Enhanced Protection is more aggressive, while Standard Protection isn’t.
That brings us back to Google's proposed Incognito improvement. The idea is to extend real-time threat checks to private browsing sessions, so they don't have to rely on locally stored threat information when more current checks are available.
Even with this improvement, users need to understand what Incognito does and doesn't offer.
Incognito does not:
- Make you anonymous: Websites can still identify you through your IP address, account logins, and other identifying information.
- Hide your activity from your ISP: Your internet service provider can still observe network connections and other traffic information.
- Make you invisible to employers or network administrators: Organizations managing the network may still monitor network activity.
- Prevent websites from tracking you: Incognito limits locally retained browsing data, but doesn't eliminate tracking techniques such as browser fingerprinting.
- Protect you from every malicious website: Since no threat intelligence can be 100% comprehensive, malicious websites may still slip through.
- Replace antivirus or endpoint security: It doesn't prevent every malicious download, infection, or exploitation attempt.
In short, Incognito is primarily a privacy feature, not a security product. Google's proposed improvement strengthens one part of its security protection, but users should still exercise the same caution they would during ordinary browsing.
What Chrome users should do while Google develops the update
Google has not announced when the proposed Safe Browsing improvement will become available in Chrome. The Chromium development note also does not establish whether other Chromium-based browsers will adopt the same change.
Until then, users should keep Chrome updated, review their Safe Browsing settings, and avoid treating Incognito or Guest mode as a substitute for security protections.
Users can review their protection level by opening Chrome's Settings, selecting Privacy and security, and navigating to Security.
For organizations managing Chrome deployments, the proposed change is another reason to review browser security policies and ensure users understand the limits of private browsing.
Incognito can help keep local browsing activity private, but it does not guarantee protection from phishing, malware, or other online threats.
In other news: Your Android phone might be running the latest apps while quietly missing critical security fixes. A new guide to Android security patch levels explains how to check your device's protection status, understand patch dates, and determine when an aging phone is no longer safe to keep using.