Conflicting security messages about "chrome://settings" page; is it secure or not?

Question

Accessing the chrome://settings page, I see two things contradicting each other:

• The ribbon below the address bar shows "You're viewing a secure Chromium Page."

• On the other hand, the security overview under the security tab in Chromium developer tools says "This Page is not secure".

Does anyone have any idea what's going on here?

1. Why these two conflicting messages ? Any vulnerability here?
2. Is the chrome://settings page really secure?
3. If not secure, does it impact the browser or anything like that?
4. What could be possible resolution?

EDIT : I want to clarify that my question is Why these two conflicting security messages ? and only after then the security stuff that is well answered by question that everybody just seems to mark this question a duplicate of :

How do browsers make sure their settings page is secure ?

So, please consider answering question 1 in the OP and then follow the rest.

If you still think the question is a duplicate, please read the answers below first and then compare it with answers given to the questions for which you think this question is a possible duplicate of.

Thanks.

Answer 1

Yes, your settings page is secure. What you're seeing is just an inconsistency on Chrome's side.

In the devtools, only valid HTTPS connections are labeled "secure". Other documents, including local files and settings pages, are shown as "not secure", even if they don't ever go through a network. The notion of a "secure connection" just doesn't apply to local resources. (A settings page is local, too.)

Why? Because the label is based on a site's SecurityState which is set to "neutral" for plain HTTP sites, local files and settings pages alike. And a "neutral" security state is verbalized as "not secure":

const summaryExplanationStrings = {
  'unknown': Common.UIString('The security of this page is unknown.'),
  'insecure': Common.UIString('This page is not secure (broken HTTPS).'),
  'neutral': Common.UIString('This page is not secure.'),
  'secure': Common.UIString('This page is secure (valid HTTPS).')
};

(Source)

In the address bar, however, Chrome has a special label for viewing an internal page:

<message name="IDS_PAGE_INFO_INTERNAL_PAGE" desc="Message to display in the page
 info bubble when the page you are on is a chrome:// page or about:something.">
    You are viewing a secure Google Chrome page.
</message>

(Source)

Hence, the texts differ. Ultimately, the security indicators in the address bar should be your preferred means of verification. In other places, such as the devtools, the UI may be not as clear.