Cyber Security

How Hash-Primarily based Secure Searching Works in Google Chrome

Written by admin

By Rohit Bhatia, Mollie Bates, Google Chrome Safety

There are numerous threats a consumer faces when looking the net. Customers could also be tricked into sharing delicate data like their passwords with a deceptive or pretend web site, additionally referred to as phishing. They could even be led into putting in malicious software program on their machines, referred to as malware, which might accumulate private information and likewise maintain it for ransom. Google Chrome, henceforth referred to as Chrome, allows its customers to guard themselves from such threats on the web. When Chrome customers browse the net with Secure Searching protections, Chrome makes use of the Secure Searching service from Google to determine and push back varied threats.

Secure Searching works in several methods relying on the consumer’s preferences. In the most typical case, Chrome makes use of the privacy-conscious Replace API (Utility Programming Interface) from the Secure Searching service. This API was developed with consumer privateness in thoughts and ensures Google will get as little details about the consumer’s looking historical past as doable. If the consumer has opted-in to “Enhanced Safety” (lined in an earlier submit) or “Make Searches and Searching Higher“, Chrome shares restricted further information with Secure Searching solely to additional enhance consumer safety.

This submit describes how Chrome implements the Replace API, with acceptable tips that could the technical implementation and particulars concerning the privacy-conscious facets of the Replace API. This ought to be helpful for customers to grasp how Secure Searching protects them, and for builders to flick through and perceive the implementation. We are going to cowl the APIs used for Enhanced Safety customers in a future submit.

Threats on the Web

When a consumer navigates to a webpage on the web, their browser fetches objects hosted on the web. These objects embody the construction of the webpage (HTML), the styling (CSS), dynamic conduct within the browser (Javascript), pictures, downloads initiated by the navigation, and different webpages embedded in the primary webpage. These objects, additionally referred to as assets, have an internet tackle which is named their URL (Uniform Useful resource Locator). Additional, URLs could redirect to different URLs when being loaded. Every of those URLs can probably host threats equivalent to phishing web sites, malware, undesirable downloads, malicious software program, unfair billing practices, and extra. Chrome with Secure Searching checks all URLs, redirects or included assets, to determine such threats and defend customers.

Secure Searching Lists

Secure Searching supplies a listing for every risk it protects customers towards on the web. A full catalog of lists which can be utilized in Chrome will be discovered by visiting chrome://safe-browsing/#tab-db-manager on desktop platforms.

An inventory doesn’t comprise unsafe net addresses, additionally known as URLs, in entirety; it will be prohibitively costly to maintain all of them in a tool’s restricted reminiscence. As an alternative it maps a URL, which will be very lengthy, by means of a cryptographic hash operate (SHA-256), to a singular fastened dimension string. This distinct fastened dimension string, referred to as a hash, permits a listing to be saved effectively in restricted reminiscence. The Replace API handles URLs solely within the type of hashes and can also be referred to as hash-based API on this submit.

Additional, a listing doesn’t retailer hashes in entirety both, as even that will be too reminiscence intensive. As an alternative, barring a case the place information will not be shared with Google and the record is small, it accommodates prefixes of the hashes. We confer with the unique hash as a full hash, and a hash prefix as a partial hash.

An inventory is up to date following the Replace API’s request frequency part. Chrome additionally follows a back-off mode in case of an unsuccessful response. These updates occur roughly each half-hour, following the minimal wait period set by the server within the record replace response.

For these concerned about looking related supply code, right here’s the place to look:

Supply Code

  1. GetListInfos() accommodates all of the lists, together with their related risk varieties, the platforms they’re used on, and their file names on disk.
  2. HashPrefixMap exhibits how the lists are saved and maintained. They’re grouped by the scale of prefixes, and appended collectively to permit fast binary search based mostly lookups.

How is hash-based URL lookup finished

For instance of a Secure Searching record, as an instance that we now have one for malware, containing partial hashes of URLs identified to host malware. These partial hashes are usually 4 bytes lengthy, however for illustrative functions, we present solely 2 bytes.

['036b', '1a02', 'bac8', 'bb90']

At any time when Chrome must verify the popularity of a useful resource with the Replace API, for instance when navigating to a URL, it doesn’t share the uncooked URL (or any piece of it) with Secure Searching to carry out the lookup. As an alternative, Chrome makes use of full hashes of the URL (and a few mixtures) to search for the partial hashes within the regionally maintained Secure Searching record. Chrome sends solely these matched partial hashes to the Secure Searching service. This ensures that Chrome supplies these protections whereas respecting the consumer’s privateness. This hash-based lookup occurs in three steps in Chrome:

Step 1: Generate URL Mixtures and Full Hashes

When Google blocks URLs that host probably unsafe assets by inserting them on a Secure Searching record, the malicious actor can host the useful resource on a special URL. A malicious actor can cycle by means of varied subdomains to generate new URLs. Secure Searching makes use of host suffixes to determine malicious domains that host malware of their subdomains. Equally, malicious actors can even cycle by means of varied subpaths to generate new URLs. So Secure Searching additionally makes use of path prefixes to determine web sites that host malware at varied subpaths. This prevents malicious actors from biking by means of subdomains or paths for brand spanking new malicious URLs, permitting strong and environment friendly identification of threats.

To include these host suffixes and path prefixes, Chrome first computes the total hashes of the URL and a few patterns derived from the URL. Following Secure Searching API’s URLs and Hashing specification, Chrome computes the total hashes of URL mixtures by following these steps:

  1. First, Chrome converts the URL right into a canonical format, as outlined within the specification.
  2. Then, Chrome generates as much as 5 host suffixes/variants for the URL.
  3. Then, Chrome generates as much as 6 path prefixes/variants for the URL.
  4. Then, for the mixed 30 host suffixes and path prefixes mixtures, Chrome generates the total hash for every mixture.

Supply Code

  1. V4LocalDatabaseManager::CheckBrowseURL is an instance which performs a hash-based lookup.
  2. V4ProtocolManagerUtil::UrlToFullHashes creates the varied URL mixtures for a URL, and computes their full hashes.


For example, as an instance {that a} consumer is attempting to go to The canonical url is The host suffixes to be tried are, and The trail prefixes are / and /blah. The 4 mixed URL mixtures are,,, and

url_combinations = ["", "","", ""]
full_hashes = ['1a02…28', 'bb90…9f', '7a9e…67', 'bac8…fa']

Step 2: Search Partial Hashes in Native Lists

Chrome then checks the total hashes of the URL mixtures towards the regionally maintained Secure Searching lists. These lists, which comprise partial hashes, don’t present a decisive malicious verdict, however can rapidly determine if the URL is taken into account not malicious. If the total hash of the URL doesn’t match any of the partial hashes from the native lists, the URL is taken into account protected and Chrome proceeds to load it. This occurs for greater than 99% of the URLs checked.

Supply Code

  1. V4LocalDatabaseManager::GetPrefixMatches will get the matching partial hashes for the total hashes of the URL and its mixtures.


Chrome finds that three full hashes 1a02…28, bb90…9f, and bac8…fa match native partial hashes. We notice that that is for demonstration functions, and a match right here is uncommon.

Step 3: Fetch Matching Full Hashes

Subsequent, Chrome sends solely the matching partial hash (not the total URL or any specific a part of the URL, and even their full hashes), to the Secure Searching service’s technique. In response, it receives the total hashes of all malicious URLs for which the total hash begins with one of many partial hashes despatched by Chrome. Chrome checks the fetched full hashes with the generated full hashes of the URL mixtures. If any match is discovered, it identifies the URL with varied threats and their severities inferred from the matched full hashes.

Supply Code

  1. V4GetHashProtocolManager::GetFullHashes performs the lookup for the total hashes for the matched partial hashes.


Chrome sends the matched partial hashes 1a02, bb90, and bac8 to fetch the total hashes. The server returns full hashes that match these partial hashes, 1a02…28, bb90…ce, and bac8…01. Chrome finds that one of many full hashes matches with the total hash of the URL mixture being checked, and identifies the malicious URL as internet hosting malware.


Secure Searching protects Chrome customers from varied malicious threats on the web. Whereas offering these protections, Chrome faces challenges equivalent to constraints in reminiscence capability, community bandwidth utilization, and a dynamic risk panorama. Chrome can also be conscious of the customers’ privateness decisions, and shares little information with Google.

In a comply with up submit, we’ll cowl the extra superior protections Chrome supplies to its customers who’ve opted in to “Enhanced Safety”.

About the author


Leave a Comment