Implement 'Not secure' warning for non-secure pages in Incognito mode

components/security_state/content/content_utils.cc

Index: components/security_state/content/content_utils.cc
diff --git a/components/security_state/content/content_utils.cc b/components/security_state/content/content_utils.cc
index 27986e01d39996d6c5319cc1ff133c065f90d62f..f1dc1154b861fd39b2d3dbb037c948a372caf253 100644
--- a/components/security_state/content/content_utils.cc
+++ b/components/security_state/content/content_utils.cc
@@ -182,16 +182,23 @@ blink::WebSecurityStyle GetSecurityStyle(
   const blink::WebSecurityStyle security_style =
       SecurityLevelToSecurityStyle(security_info.security_level);
 
-  // The HTTP_SHOW_WARNING state may occur if the page is served as a data: URI
-  // or if it is served non-securely AND contains a sensitive form field.
-  if (security_info.security_level == security_state::HTTP_SHOW_WARNING &&
-      (security_info.displayed_password_field_on_http ||
-       security_info.displayed_credit_card_field_on_http)) {
-    security_style_explanations->neutral_explanations.push_back(
-        content::SecurityStyleExplanation(
-            l10n_util::GetStringUTF8(IDS_PRIVATE_USER_DATA_INPUT),
-            l10n_util::GetStringUTF8(IDS_PRIVATE_USER_DATA_INPUT_DESCRIPTION)));
+  if (security_info.security_level == security_state::HTTP_SHOW_WARNING) {
+    if (security_info.displayed_password_field_on_http ||
+        security_info.displayed_credit_card_field_on_http) {
+      security_style_explanations->neutral_explanations.push_back(
+          content::SecurityStyleExplanation(
+              l10n_util::GetStringUTF8(IDS_PRIVATE_USER_DATA_INPUT),
+              l10n_util::GetStringUTF8(
+                  IDS_PRIVATE_USER_DATA_INPUT_DESCRIPTION)));
+    }
+    if (security_info.incognito_downgraded_security_level) {
+      security_style_explanations->neutral_explanations.push_back(
+          content::SecurityStyleExplanation(
+              l10n_util::GetStringUTF8(IDS_INCOGNITO_NONSECURE),
+              l10n_util::GetStringUTF8(IDS_INCOGNITO_NONSECURE_DESCRIPTION)));
+    }
   }
+
   security_style_explanations->ran_insecure_content_style =
       SecurityLevelToSecurityStyle(security_state::kRanInsecureContentLevel);
   security_style_explanations->displayed_insecure_content_style =