I've noticed in several occasions that on mobile browsers (I suppose it happens also on desktop ones) downloads can be forced without user consent. I've studied the matter and I've learnt that this is made possible by using server-side languages as, for example, php. The downloaded files, in these cases were malware.
I wonder if it is possible to bypass this unwanted behaviour of mobile browsers, in particular of Chrome, for which I have found the downloads are named as hidden and incomplete files, '.com.chrome.google.xyz'.
Moreover, do these standard names used by Chrome make the malware ineffective and not activable nor executable?
EDIT @Robert, I don't understand why the question was closed as OT; it seems instead very connected to Android: all I've mentioned happens on Android 7, and I think it is a very problematic and interesting matter.
I have AVs that warn me of threats all the times, and every file is trashed soon after the warning. What you've said seems imply that AVs are completely useless, because the file is processed and executed by exploiting vulnerabilities in the mentioned Android component. I knew that it was problematic on previous Android versions due to a bug of intense battery discharge caused by scanning of corrupted media files that made it go into an infinite loop. However, that component isn't listed among system apps on my device.
I've checked the offending link; I've seen only a bit of html code lines indicating 308 Permanent redirect; no resources as JS, CSS and so on. Why? Moreover the preview was completely different from the original malicious page of autodownload.
It seems as Chrome for Android acts as a trojan downloader, and what's worse, Android automatically executes the code independently of user interaction with the file (though I don't think it happened on my device)