Cyber Trackr - Google Chrome Current Windows STIG

Warning: Incompatible Browser

Incompatible Browser Detected - Internet Explorer

This web site uses advanced JavaScript for several data processing functions. Internet Explorer has severe deficiencies in it's JavaScript engine. Please use a modern day browser, such as Chrome or Edge, in order to take full advantage of this web site.

V-44711 Updated

Findings ID:	DTBC-0001	Rule ID:	SV-57545r43_rule	Severity:	medium	CCI:	~~CCI-001414~~

Discussion

Remote connections should never be allowed that bypass the firewall, as there is no way to verify if they can be trusted. Enables usage of STUN and relay servers when remote clients are trying to establish a connection to this machine. If this setting is enabled, then remote clients can discover and connect to this machine even if they are separated by a firewall. If this setting is disabled and outgoing UDP connections are filtered by the firewall, then this machine will only allow connections from client machines within the local network. If this policy is left not set the setting will be enabled.

Checks

Universal method:
1. In the omnibox (address bar) type chrome://policy
2. If RemoteAccessHostFirewallTraversal is not displayed under the Policy Name column or it is not set to false under the Policy Value column, then this is a finding.

Windows registry:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the RemoteAccessHostFirewallTraversal value name does not exist or its value data is not set to 0, then this is a finding.

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc
2. Navigate to Policy Path: Computer Configuration\Administrative\Templates\Google\Google Chrome\Configure remote access options
Policy Name: Enable firewall traversal from remote access host
Policy State: Disabled
Policy Value: N/A

V-44713 Updated

Findings ID:	DTBC-0003	Rule ID:	SV-57547r21_rule	Severity:	low	CCI:	~~CCI-000381~~

Discussion

Chrome by default allows websites to display notifications on the desktop. This check allows you to set whether or not this is permitted. Displaying desktop notifications can be allowed by default, denied by default or the user can be asked every time a website wants to show desktop notifications. If this policy is left not set, 'AskNotifications' will be used and the user will be able to change it.
1 = Allow sites to show desktop notifications
2 = Do not allow any site to show desktop notifications
3 = Ask every time a site wants to show desktop notifications

Checks

Universal method:
1. In the omnibox (address bar) type chrome://policy
2. If DefaultNotificationsSetting is not displayed under the Policy Name column or it is not set to 2, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the DefaultNotificationsSetting value name does not exist or its value data is not set to 2, then this is a finding.

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings\
Policy Name: Default notification setting
Policy State: Enabled
Policy Value: Do not allow any site to show desktop notifications

V-44719 Updated

Findings ID:	DTBC-0004	Rule ID:	SV-57553r21_rule	Severity:	medium	CCI:	~~CCI-000381~~

Discussion

Chrome allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing. If you disable this policy setting, pop-up windows are not prevented from appearing. If you disable this policy setting, scripts can continue to create pop-up windows, and pop-ups that hide other windows. Recommend configuring this setting to ‘2’ to help prevent malicious websites from controlling the pop-up windows or fooling users into clicking on the wrong window. If you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing. If this policy is left not set, 'BlockPopups' will be used and the user will be able to change it.
1 = Allow all sites to show pop-ups
2 = Do not allow any site to show pop-ups

Checks

Universal method:
1. In the omnibox (address bar) type chrome://policy
2. If DefaultPopupsSetting is not displayed under the Policy Name column or it is not set to 2, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the value name DefaultPopupsSetting does not exist or its value data is not set to 2, then this is a finding.

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings\
Policy Name: Default popups setting
Policy State: Enabled
Policy Value: Do not allow any site to show popups

V-44723 Updated

Findings ID:	DTBC-0002	Rule ID:	SV-57557r21_rule	Severity:	medium	CCI:	~~CCI-001166~~

Discussion

Website tracking is the practice of gathering information as to which websites were accesses by a browser. The common method of doing this is to have a website create a tracking cookie on the browser. If the information of what sites are being accessed is made available to unauthorized persons, this violates confidentiality requirements, and over time poses a significant OPSEC issue. This policy setting allows you to set whether websites are allowed to track the user’s physical location. Tracking the user’s physical location can be allowed by default, denied by default or the user can be asked every time a website requests the physical location.
1 = Allow sites to track the user’s physical location
2 = Do not allow any site to track the user’s physical location
3 = Ask whenever a site wants to track the user’s physical location

Checks

Universal method:
1. In the omnibox (address bar) type chrome://policy
2. If DefaultGeolocationSetting is not displayed under the Policy Name column or it is not set to 2, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the DefaultGeolocationSetting value name does not exist or its value data is not set to 2, then this is a finding.

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings\
Policy Name: Default geolocation setting
Policy State: Enabled
Policy Value: Do not allow any site to track the users' physical location

V-44727 Updated

Findings ID:	DTBC-0005	Rule ID:	SV-57561r21_rule	Severity:	medium	CCI:	~~CCI-001687~~

Discussion

Extensions are developed by third party sources and are designed to extend Google Chrome's functionality. An extension can be made by anyone, to do and access almost anything on a system; this means they pose a high risk to any system that would allow all extensions to be installed by default. Allows you to specify which extensions the users can NOT install. Extensions already installed will be removed if blacklisted. A blacklist value of '*' means all extensions are blacklisted unless they are explicitly listed in the whitelist. If this policy is left not set the user can install any extension in Google Chrome.

Checks

Universal method:
1. In the omnibox (address bar) type chrome://policy
2. If ExtensionInstallBlacklist is not displayed under the Policy Name column or it is not set to * under the Policy Value column, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlacklist
3. If the a registry value name of 1 does not exist under that key or its value is not set to *, then this is a finding.

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Extensions\
Policy Name: Configure extension installation blacklist
Policy State: Enabled
Policy Value: *

V-44729 Updated

Findings ID:	DTBC-0006	Rule ID:	SV-57563r21_rule	Severity:	medium	CCI:	~~CCI-001170~~

Discussion

The whitelist should only contain organizationally approved extensions. This is to prevent a user from accidently whitelisitng a malicious extension. This policy allows you to specify which extensions are not subject to the blacklist. A blacklist value of ‘*’ means all extensions are blacklisted and users can only install extensions listed in the whitelist. By default, no extensions are whitelisted. If all extensions have been blacklisted by policy, then the whitelist policy can be used to allow specific extensions to be installed. Administrators should determine which extensions should be allowed to be installed by their users. If no extensions are whitelisted, then no extensions can be installed when combined with blacklisting all extensions.

Checks

Universal method:

1. In the omnibox (address bar) type chrome://policy

2. If ExtensionInstallWhitelist is not displayed under the Policy Name column or it is not set to oiigbmnaadbkfbmpbfijlflahbdbdgdf or a list of administrator approved extension IDs, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to ~~the key~~ HKLM\Software\Policies\Google\Chrome\ExtensionInstallWhitelist
3. If the ExtensionInstallWhitelist key does not exist or is not set to ~~1 or~~ oiigbmnaadbkfbmpbfijlflahbdbdgdf or a list of administrator- approved extension IDs, then this is a finding.

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc

2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Extensions\
Policy Name: Configure extension installation whitelist
Policy State: Enabled
Policy Value: oiigbmnaadbkfbmpbfijlflahbdbdgdf ~~(or 1)~~

Note: oiigbmnaadbkfbmpbfijlflahbdbdgdf is the extension ID for scriptno(a commonly used Chrome extension)

V-44733 Updated

Findings ID:	DTBC-0007	Rule ID:	SV-57567r21_rule	Severity:	medium	CCI:	~~CCI-000381~~

Discussion

Specifies the name of the default search provider that is to be used, if left empty or not set, the host name specified by the search URL will be used. This policy is only considered if the 'DefaultSearchProviderEnabled' policy is enabled. When doing internet searches it is important to use an encrypted connection via https.

Checks

Universal method:
1. In the omnibox (address bar) type chrome://policy
2. If DefaultSearchProviderName is displayed under the Policy Name column or it is not set to an organization approved encrypted search provider that corresponds to the encrypted search provider set in DTBC-0008(ex. Google Encrypted, Bing Encrypted) under the Policy Value column, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the DefaultSearchProviderName value name does not exist or it is not set to an organization approved encrypted search provider that corresponds to the encrypted search provider set in DTBC-0008(ex. Google Encrypted, Bing Encrypted), then this is a finding.

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Default search provider\
Policy Name: Default search provider name
Policy State: Enabled
Policy Value: set to an organization approved encrypted search provider that corresponds to the encrypted search provider set in DTBC-0008(ex. Google Encrypted, Bing Encrypted)

V-44735 Updated

Findings ID:	DTBC-0008	Rule ID:	SV-57569r31_rule	Severity:	medium	CCI:	~~CCI-000381~~

Discussion

Specifies the URL of the search engine used when doing a default search. The URL should contain the string '{searchTerms}', which will be replaced at query time by the terms the user is searching for. This option must be set when the 'DefaultSearchProviderEnabled' policy is enabled and will only be respected if this is the case. When doing internet searches it is important to use an encrypted connection via https.

Checks

~~If the system is on the SIPRNet, this requirement is NA.~~

Universal method:

1. In the omnibox (address bar) type chrome://policy

2. If DefaultSearchProviderSearchURL is not displayed under the Policy Name column or it is not set to an organization- approved encrypted search string (ex. https://www.google.com/#q={searchTerms} or https://www.bing.com/search?q={searchTerms} ) under the Policy Value column, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the DefaultSearchProviderSearchURL value name does not exist or its value data is not set to an organization- approved encrypted search string (ex. https://www.google.com/#q={searchTerms} or https://www.bing.com/search?q={searchTerms} ) then this is a finding.

Fix

~~If the system is on the SIPRNet, this requirement is NA.~~

Windows group policy:
1. Open the group policy editor tool with gpedit.msc

2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Default search provider\
Policy Name: Default search provider search URL
Policy State: Enabled
Policy Value: Mmust be set to an organization- approved encrypted search string
(ex. https://www.google.com/#q={searchTerms} or https://www.bing.com/search?q={searchTerms} )

V-44737 Updated

Findings ID:	DTBC-0009	Rule ID:	SV-57571r31_rule	Severity:	medium	CCI:	~~CCI-000381~~

Discussion

Policy enables the use of a default search provider. If you enable this setting, a default search is performed when the user types text in the omnibox that is not a URL. You can specify the default search provider to be used by setting the rest of the default search policies. If these are left empty, the user can choose the default provider. If you disable this setting, no search is performed when the user enters non-URL text in the omnibox. If you enable or disable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set, the default search provider is enabled, and the user will be able to set the search provider list.

Checks

Universal method:

1. In the omnibox (address bar) type chrome://policy

2. If DefaultSearchProviderEnabled is not displayed under the Policy Name column or it is not set to true under the Policy Value column, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the DefaultSearchProviderEnabled value name does not exist or its value data is not set to 1, then this is a finding.

~~Note: This policy will only display in the chrome://policy tab on domain joined systems. On standalone systems, the policy will not display.~~

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Default search provider\
Policy Name: Enable the default search provider
Policy State: Enabled
Policy Value: N/A

V-44739 Added

Findings ID:	DTBC-0010	Rule ID:	SV-57573r1_rule	Severity:	medium	CCI:

Discussion

Cleartext passwords would allow another individual to see password via shoulder surfing. This policy controls whether the user may show passwords in clear text in the password manager. If you disable this setting, the password manager does not allow showing stored passwords in clear text in the password manager window. By not configuring this policy, users can view their stored passwords in clear text in the password manager.

Checks

Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If PasswordManagerAllowShowPasswords is not displayed under the Policy Name column or it is not set to false under the Policy Value column, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the PasswordManagerAllowShowPasswords value name does not exist or its value data is not set to 0, then this is a finding.

Fix

Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Password manager\ Policy Name: Allow users to show passwords in Password Manager Policy State: Disabled Policy Value: N/A

V-44741 Updated

Findings ID:	DTBC-0011	Rule ID:	SV-57575r41_rule	Severity:	medium	CCI:	~~CCI-000381~~

Discussion

Enables saving passwords and using saved passwords in Google Chrome. Malicious sites may take advantage of this feature by using hidden fields gain access to the stored information. If you enable this setting, users can have Google Chrome memorize passwords and provide them automatically the next time they log in to a site. If you disable this setting, users are not able to save passwords or use already saved passwords. If you enable or disable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set, this will be enabled but the user will be able to change it. ListPassword manager should not be used as it stores passwords locally.

Checks

Universal method:
1. In the omnibox (address bar) type chrome://policy
2. If PasswordManagerEnabled is not displayed under the Policy Name column or it is not set to false under the Policy Value column, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the PasswordManagerEnabled value name does not exist or its value data is not set to 0, then this is a finding.

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc

2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Password Manager\
Policy Name: Enable ~~Saving Passwords to the Password M~~the password manager
Policy State: Disabled
Policy Value: N/A

V-44743 Added

Findings ID:	DTBC-0012	Rule ID:	SV-57577r1_rule	Severity:	medium	CCI:

Discussion

Specifies which HTTP Authentication schemes are supported by Google Chrome. Possible values are 'basic', 'digest', 'ntlm' and 'negotiate'. Separate multiple values with commas. If this policy is left not set, all four schemes will be used.

Checks

Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If AuthSchemes is not displayed under the Policy Name column or it is not set to negotiate under the Policy Value column, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome 3. If the AuthSchemes value name does not exist or its value data is not set to negotiate, then this is a finding.

Fix

Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Policies for HTTP Authentication\ Policy Name: Supported authentication schemes Policy State: Enabled Policy Value: negotiate

V-44745 Updated

Findings ID:	DTBC-0013	Rule ID:	SV-57579r21_rule	Severity:	high	CCI:	~~CCI-001240~~

Discussion

Running outdated plugins could lead to system compromise through the use of known exploits. Having plugins that updated to the most current version ensures the smallest attack surfuce possible. If you enable this setting, outdated plugins are used as normal plugins. If you disable this setting, outdated plugins will not be used and users will not be asked for permission to run them. If this setting is not set, users will be asked for permission to run outdated plugins.

Checks

Universal method:
1. In the omnibox (address bar) type chrome://policy
2. If AllowOutdatedPlugins is not displayed under the Policy Name column or it is not set to false under the Policy Name column, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome
3. If the AllowOutdatedPlugins value name does not exist or its value data is not set to 0, then this is a finding.

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
Policy Name: Allow running plugins that are outdated
Policy State: Disabled
Policy Value: N/A

V-44749 Added

Findings ID:	DTBC-0014	Rule ID:	SV-57583r1_rule	Severity:	high	CCI:

Discussion

Policy allows Google Chrome to run plugins that require authorization. If you enable this setting, plugins that are not outdated will always run. If this setting is disabled or not set, users will be not be asked for permission to run plugins that require authorization. These are plugins that can compromise security.

Checks

Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If AlwaysAuthorizePlugins is not displayed under the Policy Name column or it is not set to false under the Policy Value column, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the AlwaysAuthorizePlugins value name does not exist or its value data is not set to 0, then this is a finding.

Fix

Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Always runs plugins that require authorization Policy State: Disabled Policy Value: N/A

V-44751 Updated

Findings ID:	DTBC-0015	Rule ID:	SV-57585r21_rule	Severity:	low	CCI:	~~CCI-000166~~

Discussion

Third party cookies are cookies which can be set by web page elements that are not from the domain that is in the browser's address bar. Enabling this setting prevents cookies from being set by web page elements that are not from the domain that is in the browser's address bar. Disabling this setting allows cookies to be set by web page elements that are not from the domain that is in the browser's address bar and prevents users from changing this setting. If this policy is left not set, third party cookies will be enabled but the user will be able to change that.

Checks

Universal method:
1. In the omnibox (address bar) type chrome://policy
2. If BlockThirdPartyCookies is not displayed under the Policy Name column or it is not set to true under the Policy Value column, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the BlockThirdPartyCookies value name does not exist or its value data is not set to 1, then this is a finding.

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
Policy Name: Block third party cookies
Policy State: Enabled
Policy Value: N/A

V-44753 Updated

Findings ID:	DTBC-0017	Rule ID:	SV-57587r21_rule	Severity:	medium	CCI:	~~CCI-001695~~

Discussion

Determines whether a Google Chrome process is started on OS login that keeps running when the last browser window is closed, allowing background apps to remain active. The background process displays an icon in the system tray and can always be closed from there. If this policy is set to True, background mode is enabled and cannot be controlled by the user in the browser settings. If this policy is set to False, background mode is disabled and cannot be controlled by the user in the browser settings. If this policy is left unset, background mode is initially disabled and can be controlled by the user in the browser settings.' - Google Chrome Administrators Policy ListThis setting, if enabled, allows Google Chrome to run at all times. There is two reasons that this is not wanted. First, it can tie up system resources that might otherwise be needed. Second, it does not make it obvious to the user that it is running and poorly written extensions could cause instability on the system.

Checks

Universal method:
1. In the omnibox (address bar) type chrome://policy
2. If BackgroundModeEnabled is not displayed under the Policy Name column and it is not set to false under the Policy Value column, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the BackgroundModeEnabled value name does not exist or its value data is not set to 0, then this is a finding.

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
Policy Name: Continue running background apps when Google Chrome is closed
Policy State: Disabled
Policy Value: N/A

V-44757 Updated

Findings ID:	DTBC-0019	Rule ID:	SV-57591r31_rule	Severity:	medium	CCI:	~~CCI-000366~~

Discussion

Disable support for 3D graphics APIs. Enabling this setting prevents web pages from accessing the graphics processing unit (GPU). Specifically, web pages cannot access the WebGL API and plugins cannot use the Pepper 3D API. Disabling this setting or leaving it not set potentially allows web pages to use the WebGL API and plugins to use the Pepper 3D API. The default settings of the browser may still require command line arguments to be passed in order to use these APIs. Chrome uses WebGL to render graphics using the GPU. There are few sites that currently take advantage of this feature. Since there is unlikely to be an operational impact, it is recommended that this feature is turned off in order to reduce the attack surface.

Checks

Universal method:

1. In the omnibox (address bar) type chrome://policy

2. If "Disable3DAPIs" is not displayed under the Policy Name column or it is not set to true under the Policy Value column, this is a finding.
Note: If 3D APIs are required by mission,en this is ~~not~~ a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the "Disable3DAPIs" value name does not exist or its value data is not set to "1", this is a finding.
Note: If 3D APIs are required by mission,1, then this is ~~not~~ a finding.

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
Policy Name: Disable support for 3D graphics APIs
Policy State: Enabled
Policy Value: N/A

V-44759 Updated

Findings ID:	DTBC-0020	Rule ID:	SV-57593r21_rule	Severity:	medium	CCI:	~~CCI-002333~~

Discussion

Disables data synchronization in Google Chrome using Google-hosted synchronization services and prevents users from changing this setting. If you enable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set the user will be able to enable Google Sync. Google Sync is used to sync information between different user devices, this data is then stored on Google owned servers. The synced data may consist of information such as email, calendars, viewing history, etc. This feature must be disabled because the organization does not have control over the servers the data is stored on.

Checks

Universal method:
1. In the omnibox (address bar) type chrome://policy
2. If SyncDisabled is not displayed under the Policy Name column or it is not set to true under the Policy Value column, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the SyncDisabled value name does not exist or its value data is not set to 1, then this is a finding.

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
Policy Name: Disable synchronization of data with Google
Policy State: Enabled
Policy Value: N/A

V-44761 Updated

Findings ID:	DTBC-0021	Rule ID:	SV-57595r32_rule	Severity:	medium	CCI:	~~CCI-000381~~

Discussion

Each access to a URL is handled by the browser according to the URL's "scheme". The "scheme" of a URL is the section before the ":". The term "protocol" is often mistakenly used for a "scheme". The difference is that the scheme is how the browser handles a URL and the protocol is how the browser communicates with a service. If a scheme or its associated protocol used by a browser is insecure or obsolete, vulnerabilities can be exploited resulting in exposed data or unrestricted access to the browser's system. The browser must be configured to disable the use of insecure and obsolete schemas (protocols).
This policy disables the listed protocol schemes in Google Chrome, URLs using a scheme from this list will not load and cannot be navigated to. If this policy is left not set or the list is empty all schemes will be accessible in Google Chrome.

Checks

Universal method:
1. In the omnibox (address bar) type chrome://policy
2. If URLBlacklist is not displayed under the Policy Name column or it is not set to javascript://* under the Policy Value column, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\URLBlacklist
3. If the URLBlacklist key does not exist, or the does not contain entries 1 set to javascript://*, then this is a finding.

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
Policy Name: Block access to a list of URLs
Policy State: Enabled
Policy Value 1: javascript://*

V-44763 Updated

Findings ID:	DTBC-0022	Rule ID:	SV-57597r21_rule	Severity:	medium	CCI:	~~CCI-000381~~

Discussion

This AutoComplete feature suggests possible matches when users are filling in forms. It is possible that this feature will cache sensitive data and store it in the user's profile, where it might not be protected as rigorously as required by organizational policy. If you enable this setting or do not set a value, AutoFill will remain under the control of the user. This will allow them to configure AutoFill profiles and to switch AutoFill on or off at their own discretion.

Checks

Universal method:
1. In the omnibox (address bar) type chrome://policy
2. If AutoFillEnabled is not displayed under the Policy Name column or it is not set to false under the Policy Value column, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the AutoFillEnabled value name does not exist or its value data is not set to 0, then this is a finding.

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
Policy Name: Enable AutoFill
Policy State: Disabled
Policy Value: N/A

V-44765 Updated

Findings ID:	DTBC-0023	Rule ID:	SV-57599r21_rule	Severity:	medium	CCI:	~~CCI-002333~~

Discussion

Policy enables Google Chrome to act as a proxy between Google Cloud Print and legacy printers connected to the machine. If this setting is enabled or not configured, users can enable the cloud print proxy by authentication with their Google account. If this setting is disabled, users cannot enable the proxy, and the machine will not be allowed to share it’s printers with Google Cloud Print. If this policy is not set, this will be enabled but the user will be able to change it.

Checks

Universal method:
1. In the omnibox (address bar) type chrome://policy
2. If CloudPrintProxyEnabled is not displayed under the Policy Name column or it is not set to false under the Policy Value column, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the CloudPrintProxyEnabled value name does not exist or its value data is not set to 0, then this is a finding.

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
Policy Name: Enable Google Cloud Print proxy
Policy State: Disabled
Policy Value: N/A

V-44769 Updated

Findings ID:	DTBC-0025	Rule ID:	SV-57603r51_rule	Severity:	medium	CCI:	~~CCI-000366~~

Discussion

Enables network prediction in Google Chrome and prevents users from changing this setting. If you enable or disable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set, this will be ~~dis~~enabled but the user will be able to change it.

Checks

Universal method:

1. In the omnibox (address bar) type chrome://policy
~~2. If "NetworkPredictionOptions"~~
2. If DnsPrefetchingEnabled is not displayed under the Policy Name column or it is not set to ~~"0"~~false under the Policy Value column, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the ~~"NetworkPredictionOptions"~~DnsPrefetchingEnabled value name does not exist or its value data is not set to "0," then this is a finding.

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc

2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
Policy Name: Enable network prediction
Policy State: EnDisabled
Policy Value: ~~Predict network actions on any network connection~~N/A

V-44771 Updated

Findings ID:	DTBC-0026	Rule ID:	SV-57605r31_rule	Severity:	medium	CCI:	~~CCI-000381~~

Discussion

Enables anonymous reporting of usage and crash-related data about Google Chrome to Google and prevents users from changing this setting. If you enable this setting, anonymous reporting of usage and crash-related data is sent to Google. A crash report could contain sensitive information from the computer's memory. If you disable this setting, anonymous reporting of usage and crash-related data is never sent to Google. If you enable or disable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set the setting will be what the user chose upon installation / first run.

Checks

Universal method:

1. In the omnibox (address bar) type chrome://policy

2. If MetricsReportingEnabled is not displayed under the Policy Name column or it is not set to false under the Policy Value column, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the MetricsReportingEnabled value name does not exist or its value data is not set to 0, then this is a finding.

~~Note: This policy will only display in the chrome://policy tab on domain joined systems. On standalone systems, the policy will not display.~~

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
Policy Name: Enable reporting of usage and crash-related data
Policy State: Disabled
Policy Value: N/A

V-44773 Updated

Findings ID:	DTBC-0027	Rule ID:	SV-57607r21_rule	Severity:	medium	CCI:	~~CCI-000381~~

Discussion

Search suggestion should be disabled as it could lead to searches being conducted that were never intended to be made. Enables search suggestions in Google Chrome's omnibox and prevents users from changing this setting. If you enable this setting, search suggestions are used. If you disable this setting, search suggestions are never used. If you enable or disable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set, this will be enabled but the user will be able to change it.

Checks

Universal method:
1. In the omnibox (address bar) type chrome://policy
2. If SearchSuggestEnabled is not displayed under the Policy Name column or it is not set to false under the Policy Value column, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the SearchSuggestEnabled value name does not exist or its value data is not set to 0, then this is a finding.

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
Policy Name: Enable search suggestions
Policy State: Disabled
Policy Value: N/A

V-44775 Updated

Findings ID:	DTBC-0029	Rule ID:	SV-57609r43_rule	Severity:	medium	CCI:	~~CCI-000381~~

Discussion

Importing of saved passwords should be disabled as it could lead to unencrypted account passwords stored on the system from another browser to be viewed. This policy forces the saved passwords to be imported from the previous default browser if enabled. If enabled, this policy also affects the import dialog. If disabled, the saved passwords are not imported. If it is not set, the user may be asked whether to import, or importing may happen automatically.

Checks

Universal method:
1. In the omnibox (address bar) type chrome://policy
2. If ImportSavedPasswords is not displayed under the Policy Name column or it is not set to false under the Policy Value column, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the ImportSavedPasswords value name does not exist or its value data is not set to 0, then this is a finding.

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
Policy Name: Import saved passwords from default browser on first run
Policy State: Disabled
Policy Value: N/A

V-44777 Updated

Findings ID:	DTBC-0030	Rule ID:	SV-57611r21_rule	Severity:	medium	CCI:	~~CCI-000166~~

Discussion

Incognito mode allows the user to browse the Internet without recording their browsing history/activity. From a forensics perspective, this is unacceptable. Best practice requires that browser history is retained. The "IncognitoModeAvailability" setting controls whether the user may utilize Incognito mode in Google Chrome. If 'Enabled' is selected or the policy is left unset, pages may be opened in Incognito mode. If 'Disabled' is selected, pages may not be opened in Incognito mode. If 'Forced' is selected, pages may be opened ONLY in Incognito mode.
0 = Incognito mode available.
1 = Incognito mode disabled.
2 = Incognito mode forced.

Checks

Universal method:
1. In the omnibox (address bar) type chrome://policy
2. If IncognitoModeAvailability is not displayed under the Policy Name column or it is not set to 1 under the Policy Value column, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the IncognitoModeAvailability value name does not exist or its value data is not set to 1, then this is a finding.

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
Policy Name: Incognito mode availability
Policy State: Enabled
Policy Value: Incognito mode disabled

V-44781 Added

Findings ID:	DTBC-0034	Rule ID:	SV-57615r1_rule	Severity:	medium	CCI:

Discussion

Specifies a list of plugins that are disabled in Google Chrome and prevents users from changing this setting. The wildcard characters * and ? can be used to match sequences of arbitrary characters. * matches an arbitrary number of characters while ? specifies an optional single character, i.e. matches zero or one characters. The escape character is \, so to match actual *, ?, or \ characters, you can put a \ in front of them. If you enable this setting, the specified list of plugins is never used in Google Chrome. The plugins are marked as disabled in about:plugins and users cannot enable them. Note that this policy can be overridden by ‘EnabledPlugins’ and ‘DisabledPluginsExceptions’. If this policy is left not set the user can use any plugin installed on the system except for hard-coded incompatible, outdated or dangerous plugins.

Checks

Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If DisabledPlugins is not displayed under the Policy Name column or it is not set to * under the Policy Value column, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\DisabledPlugins 3. If the DisabledPlugins key does not exist, or the 1 value name does not exist under that key and the value data is not set to * then this is a finding.

Fix

Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Specify a list of disabled plugins Policy State: Enabled Policy Value: *

V-44783 Added

Findings ID:	DTBC-0035	Rule ID:	SV-57617r2_rule	Severity:	medium	CCI:

Discussion

Policy specifies a list of plugins that are enabled in Google Chrome and prevents users from changing this setting. The wildcard characters '*' and '?' can be used to match sequences of arbitrary characters. '*' matches an arbitrary number of characters while '?' specifies an optional single character, i.e. matches zero or one characters. The escape character is '\', so to match actual '*', '?', or '\' characters, you can put a '\' in front of them. The specified list of plugins is always used in Google Chrome if they are installed. The plugins are marked as enabled in 'about:plugins' and users cannot disable them. Note that this policy overrides both ‘DisabledPlugins ‘and ‘DisabledPluginsExceptions’. If this policy is left not set the user can disable any plugin installed on the system.

Checks

Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If EnabledPlugins is not displayed under the Policy Name column or does not contain a list of administrator approved Plugins under the Policy Value column, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\EnabledPlugins 3. If the EnabledPlugins key does not exist and does not contain a set of administrator approved Plugins then this is a finding. Suggested: the set or subset of Shockwave Flash, Chrome PDF Viewer, Silverlight, Java*

Fix

Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Specify a list of enabled plugins Policy State: Enabled Policy Value 1: Shockwave Flash Policy Value 2: Chrome PDF Viewer Policy Value 3: Silverlight Policy Value 4: Java*

V-44787 Added

Findings ID:	DTBC-0036	Rule ID:	SV-57621r1_rule	Severity:	medium	CCI:

Discussion

The automatic search and installation of missing or not installed plugins should be disabled as this can cause significant risk if a unapproved or vulnerable plugin were to be installed without proper permissions or authorization. If you set this setting to enabled the automatic search and installation of missing plugins will be disabled in Google Chrome.

Checks

Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If DisablePluginFinder is not displayed under the Policy Name column or it is not set to true under the Policy Value column, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the DisablePluginFinder value name does not exist or its value data is not set to 1, then this is a finding.

Fix

Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Specify whether the plugin finder should be disabled Policy State: Enabled Policy Value: N/A

V-44789 Updated

Findings ID:	DTBC-0037	Rule ID:	SV-57623r21_rule	Severity:	medium	CCI:	~~CCI-000185~~

Discussion

By setting this policy to true, the previous behavior is restored and online OCSP/CRL checks will be performed. If the policy is not set, or is set to false, then Chrome will not perform online revocation checks. Certificates are revoked when they have been compromised or are no longer valid, and this option protects users from submitting confidential data to a site that may be fraudulent or not secure.

Checks

Universal method:
1. In the omnibox (address bar) type chrome://policy
2. If EnableOnlineRevocationChecks is not displayed under the Policy Name column or it is not set to true under the Policy Value column, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the EnableOnlineRevocationChecks value name does not exist or its value data is not set to 1, then this is a finding.

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
Policy Name: Whether online OCSP/CRL checks are performed
Policy State: Enabled
Policy Value: N/A

V-44791 Updated

Findings ID:	DTBC-0038	Rule ID:	SV-57625r31_rule	Severity:	medium	CCI:	~~CCI-001166~~

Discussion

Enables Google Chrome's Safe Browsing feature and prevents users from changing this setting. If you enable this setting, Safe Browsing is always active. If you disable this setting, Safe Browsing is never active. If you enable or disable this setting, users cannot change or override this setting in Google Chrome. If this policy is left not set, this will be enabled but the user will be able to change it. Safe browsing uses a signature database to test sites when they are be loaded to ensure they don't contain any known malware.

Checks

Universal method:
1. In the omnibox (address bar) type chrome://policy
2. If SafeBrowsingEnabled is not displayed under the Policy Name column or it is not set to true under the Policy Value column, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the SafeBrowsingEnabled value name does not exist or its value data is not set to 1, then this is a finding.

Fix

Windows group policy:
1. Open the “group policy editor” tool with gpedit.msc

2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\~~Safe Browsing Settings~~

Policy Name: Enable Safe Browsing
Policy State: Enabled
Policy Value: N/A

V-44793 Updated

Findings ID:	DTBC-0039	Rule ID:	SV-57627r21_rule	Severity:	medium	CCI:	~~CCI-001199~~

Discussion

This policy disables saving browser history in Google Chrome and prevents users from changing this setting. If this setting is enabled, browsing history is not saved. If this setting is disabled or not set, browsing history is saved.

Checks

Universal method:
1. In the omnibox (address bar) type chrome://policy
2. If the policy 'SavingBrowserHistoryDisabled' is not shown or is not set to false, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the SavingBrowserHistoryDisabled value name does not exist or its value data is not set to 0, then this is a finding.

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
Policy Name: Disable saving browser history
Policy State: Disabled
Policy Value: N/A

V-44795 Updated

Findings ID:	DTBC-0040	Rule ID:	SV-57629r52_rule	Severity:	medium	CCI:	~~CCI-001687~~

Discussion

This policy allows you to set whether websites are allowed to automatically run ~~the Flash~~ plugins. Automatically running ~~the Flash~~ plugins can be either allowed for all websites or denied for all websites. If this policy is left not set, 'AllowPlugins' will be used and the user will be able to change ~~this setting manually~~it.
1 = Allow all sites to automatically run ~~Flash~~ plugins
2 = Block ~~the Flash~~all plugins
3 = Click to play.

Checks

Universal method:

1. In the omnibox (address bar) type chrome://policy

2. If the policy "'DefaultPluginsSetting"' is not shown or is not set to ~~"3"~~'Click to play', this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\DefaultPluginsSetting
3. If this key ~~"DefaultPluginsSetting"~~ does not exist or is not set to ~~"3",~~3 this is a finding.

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings\
Policy Name: Default ~~Flash~~plugins setting
Policy State: Enabled
Policy Value: Click to play

V-44799 Updated

Findings ID:	DTBC-0045	Rule ID:	SV-57633r52_rule	Severity:	medium	CCI:	~~CCI-000166~~

Discussion

Policy allows you to set a list of URL patterns that specify sites which are allowed to set session only cookies. If this policy is left not set the global default value will be used for all sites either from the 'DefaultCookiesSetting' policy if it is set, or the user's personal configuration otherwise. If the 'RestoreOnStartup' policy is set to restore URLs from previous sessions this policy will not be respected and cookies will be stored permanently for those sites.

Checks

Universal method:

1. In the omnibox (address bar) type chrome://policy

2. If the policy ”'CookiesSessionOnlyForUrls~~” exists, and~~' has any defined values, this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\~~Chrome~~Google Chrome\Content Settings\CookiesSessionOnlyForUrls
3. If this key ~~exists and~~does not exist or has any defined values, this is a finding.

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc

2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings
Policy Name: Allow session only cookies on these sites
Policy State: Disabled
Policy Value: N/A

V-44801 Added

Findings ID:	DTBC-0048	Rule ID:	SV-57635r2_rule	Severity:	medium	CCI:

Discussion

When a browser is started the first web page displayed is the "home page". While the home page can be selected by the user, the default home page needs to be defined to display an approved page. If no home page is defined then there is a possibility that a URL to a malicious site may be used as a home page which could effectively cause a denial of service to the browser. The browser must have an organizationally approved default home page.

Checks

Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If HomepageLocation is not displayed under the Policy Name column or it is not set to an organizationally approved default home page. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the HomepageLocation value name does not exist or its value data is not set to an organizationally approved default home page.

Fix

Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Home page Policy Name: Configure the home page URL Policy State: Enabled Policy Value: An organizationally approved default home page.

V-44805 Updated

Findings ID:	DTBC-0050	Rule ID:	SV-57639r42_rule	Severity:	medium	CCI:	~~CCI-002614~~

Discussion

Google Chrome is being continually updated by the vendor in order to address identified security vulnerabilities. Running an older version of the browser can introduce security vulnerabilities to the system.One of the most effective defenses against exploitation of browser vulnerabilities is to ensure the version of the browser is current. Frequent updates provide corrections to discovered vulnerabilities and the timely update reduces the window for zero day attacks. Automatic installation of updates and patches is the most effective method for keeping the browser software current. The browser must have the capability to install software updates and patches automatically.

Checks

Universal method:
1. In the omnibox (address bar) type chrome://settings/help
2. Cross-reference the build information displayed with the Google Chrome site to identify the most recent build available.

If the version of Google Chrome running on the system is out of dateWindows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Update\
3. If the AutoUpdateCheckPeriodMinutes value name does not exist or its value is set to 0 or greater than 10080, this is a finding.

Fix

~~Install the latest v~~1. Start regedit
2. Navigate to Key Path: HKLM\Software\Policies\Google\Update
Value Name: AutoUpdateCheckPersio~~n of Google Chrome.~~dMinutes
Value Type: Boolean (REG_DWORD)
Value Data: 10080 or less, but not 0.

V-52795 Updated

Findings ID:	DTBC-0051	Rule ID:	SV-67011r41_rule	Severity:	medium	CCI:	~~CCI-002756~~

Discussion

This policy allows you to set a list of URL patterns that specify sites which are allowed to run the Flash plugin. If this policy is left not set, the global default value will be used for all sites either from the "DefaultPluginsSetting" policy if it is set, or the user’s personal configuration otherwise.

Checks

Universal method:
1. In the omnibox (address bar) type chrome://policy
2. If PluginsAllowedForUrls is not displayed under the Policy Name column or it is not set to a list of administrator approved URLs under the Policy Value column, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the PluginsAllowedForUrls key does not exist and it does not contain a list of administrator approved URLs then this is a finding.

Suggested: the set or subset of [*.]mil and [*.]gov

Fix

Windows group policy:
1. Open the group policy editor tool with gpedit.msc

2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings
Policy Name: Allow ~~the Flash plugin~~plugins on these sites
Policy State: Enabled
Policy Value 1: [*.]mil
Policy Value 2: [*.]gov

V-75165 Removed

Findings ID:	DTBC-0052	Rule ID:	SV-89845r2_rule	Severity:	medium	CCI:	CCI-001687

Discussion

Disabling this function will prevent users from deleting their browsing history, which could be used to identify malicious websites and files that could later be used for anti-virus and Intrusion Detection System (IDS) signatures. Furthermore, preventing users from deleting browsing history could be used to identify abusive web surfing on government systems.

Checks

Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If the policy "AllowDeletingBrowserHistory" is not shown or is not set to false, this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the "AllowDeletingBrowserHistory" value name does not exist or its value data is not set to "0", this is a finding.

Fix

Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Enable deleting browser and download history Policy State: Disabled Policy Value: N/A

V-79929 Removed

Findings ID:	DTBC-0053	Rule ID:	SV-94633r2_rule	Severity:	medium	CCI:	CCI-001687

Discussion

If the policy is enabled, the user will be asked where to save each file before downloading. If the policy is disabled, downloads will start immediately, and the user will not be asked where to save the file. If the policy is not configured, the user will be able to change this setting.

Checks

Universal method: 1. In the omnibox (address bar) type chrome:// policy 2. If "PromptForDownloadLocation" is not displayed under the "Policy Name" column or it is not set to "true" under the "Policy Value" column, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the "PromptForDownloadLocation" value name does not exist or its value data is not set to "1", this is a finding.

Fix

Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Ask where to save each file before downloading Policy State: Enabled Policy Value: N/A

V-79931 Removed

Findings ID:	DTBC-0055	Rule ID:	SV-94635r1_rule	Severity:	medium	CCI:	CCI-001687

Discussion

Configure the type of downloads that Google Chrome will completely block, without letting users override the security decision. If you set this policy, Google Chrome will prevent certain types of downloads, and will not let user bypass the security warnings. When the "Block dangerous downloads" option is chosen, all downloads are allowed, except for those that carry SafeBrowsing warnings. When the "Block potentially dangerous downloads" option is chosen, all downloads allowed, except for those that carry SafeBrowsing warnings of potentially dangerous downloads. When the "Block all downloads" option is chosen, all downloads are blocked. When this policy is not set, (or the "No special restrictions" option is chosen), the downloads will go through the usual security restrictions based on SafeBrowsing analysis results. Note that these restrictions apply to downloads triggered from web page content, as well as the 'download link...' context menu option. These restrictions do not apply to the save / download of the currently displayed page, nor does it apply to saving as PDF from the printing options. See https://developers.google.com/safe-browsing for more info on SafeBrowsing. 0 = No special restrictions 1 = Block dangerous downloads 2 = Block potentially dangerous downloads 3 = Block all downloads

Checks

Universal method: 1. In the omnibox (address bar) type chrome:// policy 2. If "DownloadRestrictions" is not displayed under the "Policy Name" column or it is not set to "1" or "2" under the "Policy Value" column, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the "DownloadRestrictions" value name does not exist or its value data is not set to "1" or "2", then this is a finding.

Fix

Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Allow download restrictions Policy State: 1 or 2 Policy Value: N/A

V-79933 Removed

Findings ID:	DTBC-0054	Rule ID:	SV-94637r1_rule	Severity:	medium	CCI:	CCI-000381

Discussion

Enabling Google Chrome's AutoFill feature allows users to auto complete credit card and address information in web forms using previously stored information. If you disable this setting, Autofill will never suggest, or fill credit card information, nor will it save additional credit card information that the user might submit while browsing the web. If you enable this setting or do not set a value, then users will be able to control the overall autofill feature (including credit cards) in the UI.

Checks

Universal method: 1. In the omnibox (address bar) type chrome:// policy 2. If "AutofillCreditCardEnabled" is not displayed under the "Policy Name" column or it is not set to "false" under the "Policy Value" column, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the "AutofillCreditCardEnabled" value name does not exist or its value data is not set to "0", then this is a finding.

Fix

Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Enable AutoFill for credit cards Policy State: Disabled Policy Value: N/A

V-81581 Removed

Findings ID:	DTBC-0064	Rule ID:	SV-96295r1_rule	Severity:	medium	CCI:	CCI-000381

Discussion

Allows you to control if videos can play automatically (without user consent) with audio content in Google Chrome. If the policy is set to “True”, Google Chrome is allowed to autoplay media. If the policy is set to “False”, Google Chrome is not allowed to autoplay media. The “AutoplayWhitelist” policy can be used to override this for certain URL patterns. By default, Google Chrome is not allowed to autoplay media. The “AutoplayWhitelist” policy can be used to override this for certain URL patterns.

Checks

Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If "AutoplayAllowed" is not displayed under the "Policy Name" column or it is not set to "False", this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the "AutoplayAllowed" value name does not exist or its value data is not set to "0", this is a finding.

Fix

Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings\ Policy Name: Allow media autoplay Policy State: Disabled Policy Value: N/A

V-81583 Removed

Findings ID:	DTBC-0056	Rule ID:	SV-96297r1_rule	Severity:	medium	CCI:	CCI-001131

Discussion

If this policy is not configured then Google Chrome uses a default minimum version, which is TLS 1.0. Otherwise, it may be set to one of the following values: "tls1", "tls1.1" or "tls1.2". When set, Google Chrome will not use SSL/TLS versions less than the specified version. An unrecognized value will be ignored. "tls1" = TLS 1.0 "tls1.1" = TLS 1.1 "tls1.2" = TLS 1.2

Checks

Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If "SSLVersionMin" is not displayed under the "Policy Name" column or it is not set to "tls1.1", this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the "SSLVersionMin" value name does not exist or its value data is not set to "tls1.1", this is a finding.

Fix

Windows group policy: 1. Open the “group policy editor” tool with gpedit.msc. 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings\ Policy Name: Minimum SSL version enabled Policy State: Enabled Policy Value: TLS 1.1

V-81585 Removed

Findings ID:	DTBC-0057	Rule ID:	SV-96299r1_rule	Severity:	medium	CCI:	CCI-001166

Discussion

Enables Google Chrome's Safe Browsing Extended Reporting and prevents users from changing this setting. Extended Reporting sends some system information and page content to Google servers to help detect dangerous apps and sites. If the setting is set to "True", then reports will be created and sent whenever necessary (such as when a security interstitial is shown). If the setting is set to "False", reports will never be sent. If this policy is set to "True" or "False", the user will not be able to modify the setting. If this policy is left unset, the user will be able to change the setting and decide whether to send reports or not.

Checks

Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If "SafeBrowsingExtendedReportingEnabled" is not displayed under the "Policy Name" column or it is not set to "False", this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the "SafeBrowsingExtendedReportingEnabled" value name does not exist or its value data is not set to "0", this is a finding.

Fix

Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings\ Policy Name: Enable Safe Browsing Extended Reporting Policy State: Disabled Policy Value: N/A

V-81587 Removed

Findings ID:	DTBC-0058	Rule ID:	SV-96301r1_rule	Severity:	medium	CCI:	CCI-000381

Discussion

Allows you to set whether websites are allowed to get access to connected USB devices. Access can be completely blocked, or the user can be asked every time a website wants to get access to connected USB devices. If this policy is left not set, ”3” will be used, and the user will be able to change it. 2 = Do not allow any site to request access to USB devices via the WebUSB API 3 = Allow sites to ask the user to grant access to a connected USB device

Checks

Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If "DefaultWebUsbGuardSetting" is not displayed under the "Policy Name" column or it is not set to "2", this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the "DefaultWebUsbGuardSetting" value name does not exist or its value data is not set to "2", this is a finding.

Fix

Windows group policy: 1. Open the “group policy editor” tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings Policy Name: Control use of the WebUSB API Policy State: Enabled Policy Value: 2

V-81589 Removed

Findings ID:	DTBC-0065	Rule ID:	SV-96303r1_rule	Severity:	medium	CCI:	CCI-001170

Discussion

Controls the whitelist of URL patterns that autoplay will always be enabled on. If the “AutoplayAllowed” policy is set to “True” then this policy will have no effect. If the “AutoplayAllowed” policy is set to “False” then any URL patterns set in this policy will still be allowed to play.

Checks

Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If “AutoplayWhitelist” is not displayed under the “Policy Name” column or it is not set to a list of administrator-approved URLs under the “Policy Value” column, this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the “AutoplayWhitelist” key does not exist and it does not contain a list of administrator-approved URLs, this is a finding. Suggested: the set or subset of [*.]mil and [*.]gov

Fix

Windows group policy: 1. Open the “group policy editor” tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings Policy Name: Allow media autoplay on a whitelist of URL patterns Policy State: Enabled Policy Value 1: [*.]mil Policy Value 2: [*.]gov

V-81591 Removed

Findings ID:	DTBC-0060	Rule ID:	SV-96305r1_rule	Severity:	medium	CCI:	CCI-000169

Discussion

If set to “False”, prevents Chrome Cleanup from scanning the system for unwanted software and performing cleanups. Manually triggering Chrome Cleanup from chrome://settings/cleanup is disabled. If set to “True” or unset, Chrome Cleanup periodically scans the system for unwanted software and should any be found, will ask the user if they wish to remove it. Manually triggering Chrome Cleanup from chrome://settings is enabled. This policy is not available on Windows instances that are not joined to a Microsoft® Active Directory® domain.

Checks

Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If "ChromeCleanupEnabled" is not displayed under the "Policy Name" column or it is not set to "False", this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the "ChromeCleanupEnabled" value name does not exist or its value data is not set to "0", this is a finding.

Fix

Windows group policy: 1. Open the “group policy editor” tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings Policy Name: Enables Chrome Cleanup on Windows Policy State: Disabled Policy Value: N/A

V-81593 Removed

Findings ID:	DTBC-0061	Rule ID:	SV-96307r1_rule	Severity:	medium	CCI:	CCI-000169

Discussion

If unset, should Chrome Cleanup detect unwanted software, it may report metadata about the scan to Google in accordance with policy set by “SafeBrowsingExtendedReportingEnabled”. Chrome Cleanup will then ask the user if they wish to clean up the unwanted software. The user can choose to share results of the cleanup with Google to assist with future unwanted software detection. These results contain file metadata and registry keys as described by the Chrome Privacy Whitepaper. If set to “false”, should Chrome Cleanup detect unwanted software, it will not report metadata about the scan to Google, overriding any policy set by “SafeBrowsingExtendedReportingEnabled”. Chrome Cleanup will ask the user if they wish to clean up the unwanted software. Results of the cleanup will not be reported to Google and the user will not have the option to do so. If set to “true”, should Chrome Cleanup detect unwanted software, it may report metadata about the scan to Google in accordance with policy set by “SafeBrowsingExtendedReportingEnabled”. Chrome Cleanup will ask the user if they wish to clean up the unwanted software. Results of the cleanup will be reported to Google and the user will not have the option to prevent it. This policy is not available on Windows instances that are not joined to a Microsoft® Active Directory® domain.

Checks

Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If "ChromeCleanupReportingEnabled" is not displayed under the "Policy Name" column or it is not set to "False", this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the "ChromeCleanupReportingEnabled" value name does not exist or its value data is not set to "0", this is a finding.

Fix

Windows group policy: 1. Open the “group policy editor” tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings Policy Name: Controls how Chrome Cleanup reports data to Google Policy State: Disabled Policy Value: N/A

V-81595 Removed

Findings ID:	DTBC-0062	Rule ID:	SV-96309r1_rule	Severity:	medium	CCI:	CCI-000381

Discussion

: If this policy is set to ”DeveloperToolsDisallowedForForceInstalledExtensions” (value 0, which is the default for enterprise users), the Developer Tools and the JavaScript console can be accessed in general, but they cannot be accessed in the context of extensions installed by enterprise policy. If this policy is set to ”DeveloperToolsAllowed” (value 1, which is the default for unmanaged users), the Developer Tools and the JavaScript console can be accessed and used in all contexts, including the context of extensions installed by enterprise policy. If this policy is set to ”DeveloperToolsDisallowed” (value 2), the Developer Tools cannot be accessed and web-site elements cannot be inspected anymore. Any keyboard shortcuts and any menu or context menu entries to open the Developer Tools or the JavaScript Console will be disabled. • 0 = Disallow usage of the Developer Tools on extensions installed by enterprise policy, allow usage of the Developer Tools in other contexts • 1 = Allow usage of the Developer Tools • 2 = Disallow usage of the Developer Tools

Checks

Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If "DeveloperToolsAvailability" is not displayed under the "Policy Name" column or it is not set to "2", this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the "DeveloperToolsAvailability" value name does not exist or its value data is not set to "2", this is a finding.

Fix

Windows group policy: 1. Open the “group policy editor” tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings Policy Name: Control where Developer Tools can be used Policy State: Enabled Policy Value: 2

V-81597 Removed

Findings ID:	DTBC-0063	Rule ID:	SV-96311r1_rule	Severity:	medium	CCI:	CCI-000381

Discussion

If this policy is set to ”True” or is not set, Google Cast will be enabled, and users will be able to launch it from the app menu, page context menus, media controls on Cast-enabled websites, and (if shown) the “Cast toolbar” icon. If this policy set to ”False”, Google Cast will be disabled.

Checks

Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If "EnableMediaRouter" is not displayed under the "Policy Name" column or it is not set to "False", this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the "EnableMediaRouter" value name does not exist or its value data is not set to "0", this is a finding.

Fix

Windows group policy: 1. Open the “group policy editor” tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings Policy Name: Enable Google Cast Policy State: Disabled Policy Value: N/A

Incompatible Browser Detected - Internet Explorer

Google Chrome Current Windows STIG

STIG Details

Comparison Details

Compare/View Releases

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix