This is exactly how HSTS is supposed to work.

Marking this WontFix for the problem, although tagging Security>UX in case they have any follow-up bugs they want to do w/r/t captive portals, beyond the existing work.

And how can you explain that it was working before the 5th august upgrade.

And captive portals works well with galaxy S7 edge ( Android 6.0 ) and galaxy A5 ( android 5.1 ). 

Google turned on HSTS for www.google.com

Ok but why does it work with the same version of chrome but on différent version of android ?

If Google turn on hsts, its applicable for all.

Is the issue that you are seeing a warning on one browser, but getting a captive portal login page on the other? Or is the problem that you cannot click through the error?

I ll try to be more clear :

I have a galaxy S5, and before the last update I haven't any problem with captive portal ( as you can see in the 3 screenshots, i tried with differents providers ).

With that one, i can't connect to hotspots when chrome is my default browser, but if i change and let the default samsung browser, no problem, i can connect my phone to hotspots.

I also have a Galaxy S7, and with the same release of chrome, but with a different version of android, no certificats warning. 

So i decided to ask my friend who own a A5, and he doesn't get the certificate warning ( also with chrome, same release, but a different release of android )

And to finish, one of my customer tried with his Note 3, and get the same problem that i have on my S5, and it's okay if he let the default browser.

So it's a new problem between chrome and android, on the new release, and it affect android phones with <= 5.0 version.

You *should* get a certificate error, on all browsers. The error is telling you that your phone is trying to connect to https://www.google.com but getting back a cert for the captive portal. This should not work in any browser. I do not know why it is working in some browsers.

As far as I see it, the main issue here is that our captive portal detection is terrible. :/ In the meantime, you should be able to go to http://www.example.com to get the login page and avoid the error.

Yes i understand that but in that case, my S7 don't tell my there is a MITM attack. But it's the same browser ( Chrome ) and the same version that in my S5.

But yes your right, if i try to change the URL that is in the navigation bar, and put an http address, i get my captive portal page.

The probleme is that it works on one of my device and not in the two, but it's the same browser ;) 

Security>UX component is deprecated in favor of the Team-Security-UX label