The Payload Delivery Vector
When you click a legitimate download link on a website, you expect to receive a single file. However, malicious websites frequently exploit browser behaviors to attempt “drive-by downloads.” They bundle malware with the file you requested and instruct the server to automatically push multiple files to your computer simultaneously. While Google Chrome has security measures to detect this, it will occasionally prompt you, asking if you want to allow the site to download multiple files. For maximum security, you should configure the browser to flatly reject these requests automatically.
How to Disable Automatic Downloads
You can instruct Chrome to enforce a strict “one click, one file” policy across the entire internet.
1. Open Google Chrome.
2. Click the three vertical dots in the top-right corner to open the main menu.
3. Select Settings.
4. In the left-hand navigation pane, click on Privacy and security.
5. Click on Site settings.
6. Scroll down to the Additional permissions section (you may need to click it to expand the list).
7. Click on Automatic downloads.
8. Change the default behaviour by selecting the radio button next to Don’t allow sites to download multiple files automatically.
Chrome will now silently block any website that attempts to push a secondary payload after your initial download. If you genuinely need to download a batch of files from a trusted source (like a corporate intranet), you can add that specific URL to the “Allowed” list at the bottom of the same settings page.