The Drive-by Download
Google Chrome features a controversial API known as “Automatic Downloads.” By default, if you click a download link on a website, that site can rapidly trigger secondary, hidden download requests in the background, attempting to push multiple files onto your hard drive simultaneously. While this is useful on legitimate cloud storage sites (when downloading an entire folder at once), malicious websites use this exact feature to perform “drive-by downloads,” secretly dropping malware, adware, or tracking scripts into your Downloads folder alongside the legitimate file you requested. To ensure your computer only receives exactly what you click on, you must lock down this API.
How to Block Automatic Downloads Globally
You can permanently lock the browser out of executing multi-file payload drops via the Site Settings.
- Open the Google Chrome desktop browser.
- Click the three vertical dots (â‹®) in the top right corner and select Settings.
- In the left-hand sidebar, click on Privacy and security.
- In the main window, click on Site settings.
- Scroll down to the bottom and click to expand Additional permissions.
- Click on Automatic downloads.
- Under the “Default behavior” heading, select the radio button for “Don’t allow sites to download multiple files automatically.”
Strict Single-File Control
The change takes effect instantly. Google Chrome will completely sever the ability of web scripts to loop the download manager. The browser will instantly auto-reject every single background request from any website attempting to push a second file onto your hard drive. Every single file transfer will now require a strict, explicit 1-to-1 physical click from your mouse, completely neutralizing the threat of silent, secondary malware payloads.