> They'd have to a) know they got a suspicious file, b) know how to find its password, and then c) upload it to Google. One scenario might be: 1. Some dodgy w

> They'd have to a) know they got a suspicious file, b) know how to find its password, and then c) upload it to Google. One scenario might be: 1. Some dodgy website A hosts a file on a different file uploader website B. 2. File is encrypted with some password that's visible on website A, but not visible to any other website that hotlinks to the file on website B. 3. User visiting website A has some idea of what they might find in the file that they just downloaded, but because website A has a dodgy reputation, and Chrome offered to check the downloaded file on their behalf, they then willingly submit the password that was found on website A. Users do #3 because it's convenient. Also, they would be protected from whatever bug that might have been triggered on extraction. Though personally what I would do is download the file, extract it locally, and scan it locally. Assuming that I trusted the website in the first place.