Google Chrome Current Windows Security Technical Implementation Guide

The Google Chrome Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: [email protected]

Details

Version / Release: V1R17

Published: 2019-10-24

Updated At: 2019-11-11 10:45:34

Compare/View Releases

Select any two versions of this STIG to compare the individual requirements

Select any old version/release of this STIG to view the previous requirements

Actions

Download

Filter


Findings
Severity Open Not Reviewed Not Applicable Not a Finding
Overall 0 0 0 0
Low 0 0 0 0
Medium 0 0 0 0
High 0 0 0 0
Drop CKL or SCAP (XCCDF) results here.

    Vuln Rule Version CCI Severity Title Description Status Finding Details Comments
    SV-57545r4_rule DTBC-0001 CCI-001414 MEDIUM Firewall traversal from remote host must be disabled. Remote connections should never be allowed that bypass the firewall, as there is no way to verify if they can be trusted. Enables usage of STUN and relay servers when remote clients are trying to establish a connection to this machine. If this setting is
    SV-57547r2_rule DTBC-0003 CCI-000381 LOW Sites ability for showing desktop notifications must be disabled. Chrome by default allows websites to display notifications on the desktop. This check allows you to set whether or not this is permitted. Displaying desktop notifications can be allowed by default, denied by default or the user can be asked every time a
    SV-57553r2_rule DTBC-0004 CCI-000381 MEDIUM Sites ability to show pop-ups must be disabled. Chrome allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing. If you disabl
    SV-57557r2_rule DTBC-0002 CCI-001166 MEDIUM Site tracking users location must be disabled. Website tracking is the practice of gathering information as to which websites were accesses by a browser. The common method of doing this is to have a website create a tracking cookie on the browser. If the information of what sites are being accessed
    SV-57561r2_rule DTBC-0005 CCI-001687 MEDIUM Extensions installation must be blacklisted by default. Extensions are developed by third party sources and are designed to extend Google Chrome's functionality. An extension can be made by anyone, to do and access almost anything on a system; this means they pose a high risk to any system that would allow all
    SV-57563r2_rule DTBC-0006 CCI-001170 MEDIUM Extensions that are approved for use must be whitelisted. The whitelist should only contain organizationally approved extensions. This is to prevent a user from accidently whitelisitng a malicious extension. This policy allows you to specify which extensions are not subject to the blacklist. A blacklist value of
    SV-57567r2_rule DTBC-0007 CCI-000381 MEDIUM The default search providers name must be set. Specifies the name of the default search provider that is to be used, if left empty or not set, the host name specified by the search URL will be used. This policy is only considered if the 'DefaultSearchProviderEnabled' policy is enabled. When doing inte
    SV-57569r3_rule DTBC-0008 CCI-000381 MEDIUM The default search provider URL must be set to perform encrypted searches. Specifies the URL of the search engine used when doing a default search. The URL should contain the string '{searchTerms}', which will be replaced at query time by the terms the user is searching for. This option must be set when the 'DefaultSearchProvide
    SV-57571r3_rule DTBC-0009 CCI-000381 MEDIUM Default search provider must be enabled. Policy enables the use of a default search provider. If you enable this setting, a default search is performed when the user types text in the omnibox that is not a URL. You can specify the default search provider to be used by setting the rest of the def
    SV-57575r4_rule DTBC-0011 CCI-000381 MEDIUM The Password Manager must be disabled. Enables saving passwords and using saved passwords in Google Chrome. Malicious sites may take advantage of this feature by using hidden fields gain access to the stored information. If you enable this setting, users can have Google Chrome memorize passwor
    SV-57579r2_rule DTBC-0013 CCI-001240 HIGH The running of outdated plugins must be disabled. Running outdated plugins could lead to system compromise through the use of known exploits. Having plugins that updated to the most current version ensures the smallest attack surfuce possible. If you enable this setting, outdated plugins are used as norm
    SV-57585r2_rule DTBC-0015 CCI-000166 LOW Third party cookies must be blocked. Third party cookies are cookies which can be set by web page elements that are not from the domain that is in the browser's address bar. Enabling this setting prevents cookies from being set by web page elements that are not from the domain that is in the
    SV-57587r2_rule DTBC-0017 CCI-001695 MEDIUM Background processing must be disabled. Determines whether a Google Chrome process is started on OS login that keeps running when the last browser window is closed, allowing background apps to remain active. The background process displays an icon in the system tray and can always be closed fro
    SV-57591r3_rule DTBC-0019 CCI-000366 MEDIUM 3D Graphics APIs must be disabled. Disable support for 3D graphics APIs. Enabling this setting prevents web pages from accessing the graphics processing unit (GPU). Specifically, web pages cannot access the WebGL API and plugins cannot use the Pepper 3D API. Disabling this setting or leavi
    SV-57593r2_rule DTBC-0020 CCI-002333 MEDIUM Google Data Synchronization must be disabled. Disables data synchronization in Google Chrome using Google-hosted synchronization services and prevents users from changing this setting. If you enable this setting, users cannot change or override this setting in Google Chrome. If this policy is left no
    SV-57595r3_rule DTBC-0021 CCI-000381 MEDIUM The URL protocol schema javascript must be disabled. Each access to a URL is handled by the browser according to the URL's "scheme". The "scheme" of a URL is the section before the ":". The term "protocol" is often mistakenly used for a "scheme". The difference is that the scheme is how the browser handles
    SV-57599r2_rule DTBC-0023 CCI-002333 MEDIUM Cloud print sharing must be disabled. Policy enables Google Chrome to act as a proxy between Google Cloud Print and legacy printers connected to the machine. If this setting is enabled or not configured, users can enable the cloud print proxy by authentication with their Google account. If th
    SV-57603r8_rule DTBC-0025 CCI-000366 MEDIUM Network prediction must be disabled. Enables network prediction in Google Chrome and prevents users from changing this setting. If you enable or disable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set, this will be disabled but the
    SV-57605r3_rule DTBC-0026 CCI-000381 MEDIUM Metrics reporting to Google must be disabled. Enables anonymous reporting of usage and crash-related data about Google Chrome to Google and prevents users from changing this setting. If you enable this setting, anonymous reporting of usage and crash-related data is sent to Google. A crash report coul
    SV-57607r2_rule DTBC-0027 CCI-000381 MEDIUM Search suggestions must be disabled. Search suggestion should be disabled as it could lead to searches being conducted that were never intended to be made. Enables search suggestions in Google Chrome's omnibox and prevents users from changing this setting. If you enable this setting, search
    SV-57609r4_rule DTBC-0029 CCI-000381 MEDIUM Importing of saved passwords must be disabled. Importing of saved passwords should be disabled as it could lead to unencrypted account passwords stored on the system from another browser to be viewed. This policy forces the saved passwords to be imported from the previous default browser if enabled. I
    SV-57611r2_rule DTBC-0030 CCI-000166 MEDIUM Incognito mode must be disabled. Incognito mode allows the user to browse the Internet without recording their browsing history/activity. From a forensics perspective, this is unacceptable. Best practice requires that browser history is retained. The "IncognitoModeAvailability" settin
    SV-57623r2_rule DTBC-0037 CCI-000185 MEDIUM Online revocation checks must be done. By setting this policy to true, the previous behavior is restored and online OCSP/CRL checks will be performed. If the policy is not set, or is set to false, then Chrome will not perform online revocation checks. Certificates are revoked when they have be
    SV-57625r3_rule DTBC-0038 CCI-001166 MEDIUM Safe Browsing must be enabled, Enables Google Chrome's Safe Browsing feature and prevents users from changing this setting. If you enable this setting, Safe Browsing is always active. If you disable this setting, Safe Browsing is never active. If you enable or disable this setting, use
    SV-57627r2_rule DTBC-0039 CCI-001199 MEDIUM Browser history must be saved. This policy disables saving browser history in Google Chrome and prevents users from changing this setting. If this setting is enabled, browsing history is not saved. If this setting is disabled or not set, browsing history is saved.
    SV-57629r5_rule DTBC-0040 CCI-001687 MEDIUM Default behavior must block webpages from automatically running plugins. This policy allows you to set whether websites are allowed to automatically run the Flash plugin. Automatically running the Flash plugin can be either allowed for all websites or denied for all websites. If this policy is left not set, the user will be ab
    SV-57633r5_rule DTBC-0045 CCI-000166 MEDIUM Session only based cookies must be disabled. Policy allows you to set a list of URL patterns that specify sites which are allowed to set session only cookies. If this policy is left not set the global default value will be used for all sites either from the 'DefaultCookiesSetting' policy if it is se
    SV-57639r6_rule DTBC-0050 CCI-002605 MEDIUM The version of Google Chrome running on the system must be a supported version. Google Chrome is being continually updated by the vendor in order to address identified security vulnerabilities. Running an older version of the browser can introduce security vulnerabilities to the system.
    SV-67011r5_rule DTBC-0051 CCI-000381 MEDIUM URLs must be whitelisted for plugin use This policy allows you to set a list of URL patterns that specify sites which are allowed to run the Flash plugin. If this policy is left not set, the global default value will be used for all sites either from the "DefaultPluginsSetting" policy if it is
    SV-89845r2_rule DTBC-0052 CCI-001687 MEDIUM Deletion of browser history must be disabled. Disabling this function will prevent users from deleting their browsing history, which could be used to identify malicious websites and files that could later be used for anti-virus and Intrusion Detection System (IDS) signatures. Furthermore, preventing
    SV-94633r2_rule DTBC-0053 CCI-001687 MEDIUM Prompt for download location must be enabled. If the policy is enabled, the user will be asked where to save each file before downloading. If the policy is disabled, downloads will start immediately, and the user will not be asked where to save the file. If the policy is not configured, the user will
    SV-94635r1_rule DTBC-0055 CCI-001687 MEDIUM Download restrictions must be configured. Configure the type of downloads that Google Chrome will completely block, without letting users override the security decision. If you set this policy, Google Chrome will prevent certain types of downloads, and will not let user bypass the security warnin
    SV-96295r2_rule DTBC-0064 CCI-000381 MEDIUM Autoplay must be disabled. Allows you to control if videos can play automatically (without user consent) with audio content in Google Chrome. If the policy is set to “True”, Google Chrome is allowed to autoplay media. If the policy is set to “False”, Google Chrome is not al
    SV-96297r3_rule DTBC-0056 CCI-002450 MEDIUM Chrome must be configured to allow only TLS. If this policy is not configured then Google Chrome uses a default minimum version, which is TLS 1.0. Otherwise, it may be set to one of the following values: "tls1", "tls1.1" or "tls1.2". When set, Google Chrome will not use SSL/TLS versions less than th
    SV-96299r2_rule DTBC-0057 CCI-001166 MEDIUM Safe Browsing Extended Reporting must be disabled. Enables Google Chrome's Safe Browsing Extended Reporting and prevents users from changing this setting. Extended Reporting sends some system information and page content to Google servers to help detect dangerous apps and sites. If the setting is set to "
    SV-96301r1_rule DTBC-0058 CCI-000381 MEDIUM WebUSB must be disabled. Allows you to set whether websites are allowed to get access to connected USB devices. Access can be completely blocked, or the user can be asked every time a website wants to get access to connected USB devices. If this policy is left not set, ”3” wi
    SV-96303r2_rule DTBC-0065 CCI-001170 MEDIUM URLs must be whitelisted for Autoplay use. Controls the whitelist of URL patterns that autoplay will always be enabled on. If the “AutoplayAllowed” policy is set to “True” then this policy will have no effect. If the “AutoplayAllowed” policy is set to “False” then any URL patterns
    SV-96305r2_rule DTBC-0060 CCI-000169 MEDIUM Chrome Cleanup must be disabled. If set to “False”, prevents Chrome Cleanup from scanning the system for unwanted software and performing cleanups. Manually triggering Chrome Cleanup from chrome://settings/cleanup is disabled. If set to “True” or unset, Chrome Cleanup periodicall
    SV-96307r2_rule DTBC-0061 CCI-000169 MEDIUM Chrome Cleanup reporting must be disabled. If unset, should Chrome Cleanup detect unwanted software, it may report metadata about the scan to Google in accordance with policy set by “SafeBrowsingExtendedReportingEnabled”. Chrome Cleanup will then ask the user if they wish to clean up the unwan
    SV-96311r2_rule DTBC-0063 CCI-000381 MEDIUM Google Cast must be disabled. If this policy is set to ”True” or is not set, Google Cast will be enabled, and users will be able to launch it from the app menu, page context menus, media controls on Cast-enabled websites, and (if shown) the “Cast toolbar” icon. If this policy
    SV-101303r1_rule DTBC-0066 CCI-001166 MEDIUM Anonymized data collection must be disabled. Enable URL-keyed anonymized data collection in Google Chrome and prevent users from changing this setting. URL-keyed anonymized data collection sends URLs of pages the user visits to Google to make searches and browsing better. If you enable this policy,
    SV-101305r1_rule DTBC-0067 CCI-001166 MEDIUM Collection of WebRTC event logs must be disabled. If the policy is set to “true”, Google Chrome is allowed to collect WebRTC event logs from Google services (e.g., Google Meet), and upload those logs to Google. If the policy is set to “false”, or is unset, Google Chrome may not collect nor upload
    SV-106629r1_rule DTBC-0068 CCI-001312 LOW Chrome development tools must be disabled. Information needed by an attacker to begin looking for possible vulnerabilities in a web browser includes any information about the web browser and plug-ins or modules being used. When debugging or trace information is enabled in a production web browser,