Google will roll out a Safe Browsing update later this month that will provide real-time malware and phishing protection to all Chrome users, without compromising their browsing privacy.

The company launched Safe Browsing in 2005 to defend users against web phishing attacks and has since upgraded it to block malicious domains that push malware, unwanted software, and various social engineering schemes.

An opt-in Safe Browsing Enhanced Protection mode, which uses AI to block attacks, is also available for those who want fast and proactive protection enabled by deeper scans of downloaded files. 

Currently, the standard Safe Browsing feature checks sites, downloads, and extensions against a local list of malicious URLs downloaded from Google's servers every 30 to 60 minutes.

However, Google plans to switch to real-time checks against its server-side list to keep up with ephemeral malicious websites that surface and disappear in under 10 minutes.

"Safe Browsing already protects more than 5 billion devices worldwide, defending against phishing, malware, unwanted software and more. In fact, Safe Browsing assesses more than 10 billion URLs and files every day, showing more than 3 million user warnings for potential threats," said Google's Jasika Bawa and Jonathan Li.

"If we suspect a site poses a risk to you or your device, you'll see a warning with more information. By checking sites in real time, we expect to block 25% more phishing attempts. The new capability — also rolling out to Android later this month — uses encryption and other privacy-enhancing techniques to ensure that no one, including Google, knows what website you're visiting."

Google says its Safe Browsing real-time protection protects users' privacy with a new API that uses Fastly Oblivious HTTP (OHTTP) relays to obfuscate visited sites' URLs.

The users' partially hashed URLs are relayed to Google's Safe Browsing engine via an OHTTP privacy server that hides their IP addresses and mixes the hash checks with those sent from other users' web browsers for added privacy protection.

Hash prefixes are also encrypted before being sent through the privacy server to Safe Browsing using a public key known only by Google's URL-checking service.

"The privacy server then removes potential user identifiers such as your IP address and forwards the encrypted hash prefixes to the Safe Browsing server. The privacy server is operated independently by Fastly, meaning that Google doesn't have access to potential user identifiers (including IP address and User Agent) from the original request," Google explained in a separate blog post.

"Once the Safe Browsing server receives the encrypted hash prefixes from the privacy server, it decrypts the hash prefixes with its private key and then continues to check the server-side list."

According to Google, Google and Fastly will not be able to match users' browsing activity with their identity by decrypting both the URL hash prefixes and the IP addresses they originate from, thus ensuring the users' privacy.

Google announced the Safe Browsing real-time phishing protection feature in September when it also shared its plans to use privacy-preserving Fastly Oblivious HTTP relays to collect hashed URLs for checking without exposing users' IP addresses and request headers.