What is 'mixed content' in a secure web page and how does active vs passive mixed content differ in risk?

• A.Scripts, stylesheets, iframes over HTTP on an HTTPS page (active mixed content) allow only denial of service - a network attacker can drop the HTTP resource to break the page. Modern browsers upgrade active mixed content silently. Passive mixed content (images, audio, video) allows content replacement but is never blocked - browsers may show a warning because it cannot execute code in the page of the site
• B.Mixed content over HTTP on an HTTPS page is dangerous only for images (passive mixed content), because attackers can swap them for phishing banners - active mixed content such as scripts is blocked by the firewall of the site. Modern browsers often warn about passive content, but never about scripts since the network layer already filters them out, a gap that attackers exploit on public Wi-Fi networks in airports
• C.Active mixed content (scripts, stylesheets, iframes over HTTP on an HTTPS page) allows full MitM attacks - a network attacker can modify the HTTP resource to inject code executing in the page's origin. Modern browsers block active mixed content entirely. Passive mixed content (images, audio, video) allows content replacement but cannot execute code - browsers may show a warning but often allow it