First thing, that quote is wrong. Chrome will still allow HTTP requests to private IP addresses if the site you're on also has a private IP address. https://de

First thing, that quote is wrong. Chrome will still allow HTTP requests to private IP addresses if the site you're on also has a private IP address. https://developer.chrome.com/blog/private-network-access-update/ https://developer.chrome.com/blog/private-network-access-upd... To answer your question: HTTP is vulnerable to MITM attacks. For example your ISP can modify any page you visit, steal passwords, cookies, oauth tokens, etc. If the site is forced to switch to HTTPS, your ISP can no longer pull off this attack. Full disclosure I work at Google, but not on Chrome.