This template is ONLY for reporting security bugs. If you are reporting a
Download Protection Bypass bug, please use the "Security - Download
Protection" template. For all other reports, please use a different
template.

Please READ THIS FAQ before filing a bug: https://chromium.googlesource.com
/chromium/src/+/master/docs/security/faq.md

Please see the following link for instructions on filing security bugs:
https://www.chromium.org/Home/chromium-security/reporting-security-bugs

NOTE: Security bugs are normally made public once a fix has been widely
deployed.

VULNERABILITY DETAILS

**Summary:**
When the user visits an HTTPs website, Google Chrome already shows a warning when any of the assets on the website are downloaded via unencrypted HTTP (see Mixed Content docs https://developers.google.com/web/fundamentals/security/prevent-mixed-content/fixing-mixed-content)

However this is not the case for file downloads when downloading a file from an unencrypted URL as part of a HTTP website.

This is a big problem, as anyone in the same network can easily do a man-in-the-middle attack to read & replace the content of the file.

**Steps to Reproduce:**
- Visit an HTTPs encrypted website, notice the green "Secure HTTPS" badge next the URL
- The user feels safe and thinks everything on this website is encrypted
- Click a download button for any kind of file, linking to an unencrypted HTTP URL

**Expected Results:**
The browser shows a warning or ideally an error that the download this website tries to trigger is unsafe.

**Actual Results:**
The download works just fine, giving no indication to the user that it happened over unencrypted HTTP.


VERSION
Chrome Version: 62.0.3202.94 + stable
Operating System: macOS 10.12.6

REPRODUCTION CASE
The easiest way to test it, is to visit https://aws.amazon.com/mobile/resources/, modify the HTML DOM of the `Download SDK` button to use a HTTP URL instead of HTTPs, and click the `Download SDK` button afterwards.

Here is a video showing the problem in action: https://www.youtube.com/watch?v=Mx2oFCyWg2A&feature=youtu.be

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash: none
Crash State: none
Client ID (if relevant): [see link above]