-
Google is working on real-time Safe Browsing checks for Incognito and Guest mode, according to a new Chromium change.
-
The feature is experimental and off by default. Google has yet to announce a release date.
-
Despite the upgraded checks, Incognito still doesn’t hide user activity from websites, schools, employers, or internet providers.
Chrome’s Incognito mode has a quiet weakness. In some cases, it checks sites against an older threat list instead of Google’s live data.
That gap could close soon. Industry publishers have spotted a Chromium change that would bring real-time Safe Browsing checks to Incognito and Guest mode.
However, the work is still in its early stages. While certain key details remain unclear, here is what the change would do and what it means for your privacy.
How Chrome Checks Sites Today
Safe Browsing is Chrome’s warning system for phishing, malware, and other dangerous pages. Most people use the default Standard Protection setting. With it, Chrome first looks for a site on a list of known-safe sites on your device. Dangerous online platforms can also support wider criminal activity, as seen in a dark web drug market linked to fatal fentanyl sales that involved an FBI informant early this year.
If the site is missing, Chrome sends a scrambled piece of the address to Google. That request passes through a privacy server, which hides your IP address. Google then tells Chrome whether the page is dangerous.
Incognito can work differently. Google’s help page says Chrome may check a list of unsafe sites on your device instead. The same fallback applies when the privacy server request fails. Chromium’s developer notes agree. They say Incognito gets the local check when real-time checks are unavailable.
This does not mean Incognito has no protection. The local list still catches known threats. Google also says Chrome sends a scrambled piece of the address if it sees signs of suspicious behavior. Still, Google turns off some security features in Incognito. The goal is to avoid sharing extra data.
A device list goes stale. Google has said Chrome’s local list updates every 30 to 60 minutes. It has also said the average malicious site lasts less than 10 minutes. As a result, a phishing page can appear and vanish before your list catches up.
Google tackled this for regular browsing in March 2024. It moved Standard Protection to live checks. At the time, Google expected the change to block 25 percent more phishing attempts. That number was a forecast for regular windows. It does not describe Incognito.
The Essence of the New Change
According to Windows Report, Google is building real-time checks for both Incognito and Guest mode. Support reportedly covers Standard and Enhanced Protection users. Enhanced Protection sends more data to Google. That includes page addresses and small samples of page content.
Privacy is the obvious concern, since it is the main reason people open Incognito. Google’s 2024 design offers a clue. Fastly runs the privacy server for regular windows. The setup splits the information.
Google sees a scrambled piece of the address but not your IP address. Fastly sees your IP address but not the address piece. No single party sees both. Still, nobody has confirmed that private sessions would use the same setup.
Windows Report points to one safeguard. Temporary security-key updates during an Incognito session would stay in memory. Chrome would not write them to your device’s storage.
That detail helps, but it has limits. It covers what stays on your device. It says nothing about what travels over the network. The reports do not say exactly what data private sessions would send.
One more point matters here. Google’s current help page names only Incognito for the local-list fallback. So Guest mode coverage comes from Windows Report alone.
The feature remains under development. It sits behind an experimental Chrome flag and is off by default. Google has not announced a release date or a Chrome version. Plans can also change before anything ships.
The safety benefit is expected, not proven. A newly spotted phishing page could trigger a warning sooner. But nobody has measured that in private sessions yet.
Incognito is Still not Anonymous
Google touts Incognito as a way for users to limit what Chrome saves on their device. As soon as you close your Incognito window, Chrome removes the site data and doesn’t store any record of the sites you visited. Bookmarks and downloads stay.
Websites can still see your visit. So can the groups that run your network. Google lists schools, employers, and internet providers. Sites that use Google services also share activity with Google, including for advertising. Faster threat checks would not change any of that.
What’s Next?
The new setting cannot be enabled just yet, but you can view your existing protection. Go to Chrome’s menu and select Settings. Then go to Privacy and security and then Security. Under Safe Browsing, you can view your setting. The default is Standard. Enhanced offers greater protection at the expense of giving more information to Google.
Until the update goes live, use caution when clicking links opened in private windows. When possible, type addresses directly. Additionally, do not enter passwords after getting to a website via an unexpected message.
