BaselineWatch
3 STIGs
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

Browsers STIGs

3 STIGs followed · All platforms
All 46 CAT I 0CAT II 44CAT III 2 Browse in the Register

CAT II 44

Any vulnerability, the exploitation of which has a potential to result in loss of confidentiality, availability or integrity.

  1. DTBC-0001 CAT II V-221558 · SRG-APP-000039

    Firewall traversal from remote host must be disabled.

    Maps to AC-4 via CCI-001414
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If RemoteAccessHostFirewallTraversal is not displayed under the Policy Name column or it is not set to false under the Policy Value column, then this is a finding. Windows registry: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the RemoteAccessHostFirewallTraversal value name does not exist or its value data is not set to 0, then this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative\Templates\Google\Google Chrome\Remote Access Policy Name: Enable firewall traversal from remote access host Policy State: Disabled Policy Value: N/A

  2. DTBC-0002 CAT II V-221559 · SRG-APP-000206

    Site tracking users location must be disabled.

    Maps to SC-18(1) via CCI-001166
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If DefaultGeolocationSetting is not displayed under the Policy Name column or it is not set to 2, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the DefaultGeolocationSetting value name does not exist or its value data is not set to 2, then this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings\ Policy Name: Default geolocation setting Policy State: Enabled Policy Value: Do not allow any site to track the users' physical location

  3. DTBC-0004 CAT II V-221561 · SRG-APP-000141

    Sites ability to show pop-ups must be disabled.

    Maps to CM-7 via CCI-000381
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If DefaultPopupsSetting is not displayed under the Policy Name column or it is not set to 2, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the value name DefaultPopupsSetting does not exist or its value data is not set to 2, then this is a finding. Note: If AO Approved exceptions to this rule have been enabled, this is not a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings\ Policy Name: Default popups setting Policy State: Enabled Policy Value: Do not allow any site to show popups

  4. DTBC-0005 CAT II V-221562 · SRG-APP-000089

    Extensions installation must be blocklisted by default.

    Maps to AU-12 via CCI-000169
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If ExtensionInstallBlocklist is not displayed under the Policy Name column or it is not set to * under the Policy Value column, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist 3. If the a registry value name of 1 does not exist under that key or its value is not set to *, then this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Extensions\ Policy Name: Configure extension installation blocklist Policy State: Enabled Policy Value: *

  5. DTBC-0007 CAT II V-221564 · SRG-APP-000141

    The default search providers name must be set.

    Maps to CM-7 via CCI-000381
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If DefaultSearchProviderName is displayed under the Policy Name column or it is not set to an organization approved encrypted search provider that corresponds to the encrypted search provider set in DTBC-0008(ex. Google Encrypted, Bing Encrypted) under the Policy Value column, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the DefaultSearchProviderName value name does not exist or it is not set to an organization approved encrypted search provider that corresponds to the encrypted search provider set in DTBC-0008(ex. Google Encrypted, Bing Encrypted), then this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Default search provider\ Policy Name: Default search provider name Policy State: Enabled Policy Value: set to an organization approved encrypted search provider that corresponds to the encrypted search provider set in DTBC-0008(ex. Google Encrypted, Bing Encrypted)

  6. DTBC-0008 CAT II V-221565 · SRG-APP-000141

    The default search provider URL must be set to perform encrypted searches.

    Maps to CM-7 via CCI-000381
    Check

    If the system is on the SIPRNet, this requirement is NA. Universal method: 1. In the omnibox (address bar) type chrome://policy. 2. If DefaultSearchProviderSearchURL is not displayed under the Policy Name column or it is not set to an organization-approved encrypted search string (ex. https://www.google.com/search?q={searchTerms} or https://www.bing.com/search?q={searchTerms} ) under the Policy Value column, this is a finding. Windows method: 1. Start regedit. 2. Navigate to HKLM\Software\Policies\Google\Chrome\. 3. If the DefaultSearchProviderSearchURL value name does not exist or its value data is not set to an organization-approved encrypted search string (ex. https://www.google.com/search?q={searchTerms} or https://www.bing.com/search?q={searchTerms} ), this is a finding.

    Fix

    If the system is on the SIPRNet, this requirement is NA. Windows group policy: 1. Open the group policy editor tool with gpedit.msc. 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Default search provider\. - Policy Name: Default search provider search URL - Policy State: Enabled - Policy Value: Must be set to an organization-approved encrypted search string (ex. https://www.google.com/search?q={searchTerms} or https://www.bing.com/search?q={searchTerms} )

  7. DTBC-0009 CAT II V-221566 · SRG-APP-000141

    Default search provider must be enabled.

    Maps to CM-7 via CCI-000381
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If DefaultSearchProviderEnabled is not displayed under the Policy Name column or it is not set to true under the Policy Value column, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the DefaultSearchProviderEnabled value name does not exist or its value data is not set to 1, then this is a finding. Note: This policy will only display in the chrome://policy tab on domain joined systems. On standalone systems, the policy will not display.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Default search provider\ Policy Name: Enable the default search provider Policy State: Enabled Policy Value: N/A

  8. DTBC-0011 CAT II V-221567 · SRG-APP-000141

    The Password Manager must be disabled.

    Maps to CM-7 via CCI-000381
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If PasswordManagerEnabled is not displayed under the Policy Name column or it is not set to false under the Policy Value column, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the PasswordManagerEnabled value name does not exist or its value data is not set to 0, then this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Password Manager\ Policy Name: Enable Saving Passwords to the Password Manager Policy State: Disabled Policy Value: N/A

  9. DTBC-0017 CAT II V-221570 · SRG-APP-000112

    Background processing must be disabled.

    Maps to SC-18(3) via CCI-001695
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If BackgroundModeEnabled is not displayed under the Policy Name column and it is not set to false under the Policy Value column, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the BackgroundModeEnabled value name does not exist or its value data is not set to 0, then this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Continue running background apps when Google Chrome is closed Policy State: Disabled Policy Value: N/A

  10. DTBC-0020 CAT II V-221571 · SRG-APP-000047

    Google Data Synchronization must be disabled.

    Maps to AC-4(15) via CCI-001374
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If SyncDisabled is not displayed under the Policy Name column or it is not set to true under the Policy Value column, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the SyncDisabled value name does not exist or its value data is not set to 1, then this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Disable synchronization of data with Google Policy State: Enabled Policy Value: N/A

  11. DTBC-0021 CAT II V-221572 · SRG-APP-000141

    The URL protocol schema javascript must be disabled.

    Maps to CM-7 via CCI-000381
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy. 2. If URLBlocklist is not displayed under the Policy Name column or it is not set to javascript://* under the Policy Value column, this is a finding. Windows method: 1. Start regedit. 2. Navigate to HKLM\Software\Policies\Google\Chrome\URLBlocklist. 3. If the URLBlocklist key does not exist, or the does not contain entries 1 set to javascript://*, this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc. 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Block access to a list of URLs. - Policy State: Enabled - Policy Value 1: javascript://*

  12. DTBC-0023 CAT II V-221573 · SRG-APP-000047

    Cloud print sharing must be disabled.

    Maps to AC-4(15) via CCI-001374
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If CloudPrintProxyEnabled is not displayed under the Policy Name column or it is not set to false under the Policy Value column, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the CloudPrintProxyEnabled value name does not exist or its value data is not set to 0, then this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Printing Policy Name: Enable Google Cloud Print proxy Policy State: Disabled Policy Value: N/A

  13. DTBC-0025 CAT II V-221574 · SRG-APP-000516

    Network prediction must be disabled.

    Maps to CM-6 via CCI-000366
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If "NetworkPredictionOptions" is not displayed under the “Policy Name” column or it is not set to "2" under the “Policy Value” column, this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the "NetworkPredictionOptions" value name does not exist or its value data is not set to "2," this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Enable network prediction Policy State: Enabled Policy Value: Do not predict network actions on any network connection

  14. DTBC-0026 CAT II V-221575 · SRG-APP-000141

    Metrics reporting to Google must be disabled.

    Maps to CM-7 via CCI-000381
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If MetricsReportingEnabled is not displayed under the Policy Name column or it is not set to false under the Policy Value column, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the MetricsReportingEnabled value name does not exist or its value data is not set to 0, then this is a finding. Note: This policy will only display in the chrome://policy tab on domain joined systems. On standalone systems, the policy will not display.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Enable reporting of usage and crash-related data Policy State: Disabled Policy Value: N/A

  15. DTBC-0027 CAT II V-221576 · SRG-APP-000141

    Search suggestions must be disabled.

    Maps to CM-7 via CCI-000381
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If SearchSuggestEnabled is not displayed under the Policy Name column or it is not set to false under the Policy Value column, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the SearchSuggestEnabled value name does not exist or its value data is not set to 0, then this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Enable search suggestions Policy State: Disabled Policy Value: N/A

  16. DTBC-0029 CAT II V-221577 · SRG-APP-000141

    Importing of saved passwords must be disabled.

    Maps to CM-7 via CCI-000381
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If ImportSavedPasswords is not displayed under the Policy Name column or it is not set to false under the Policy Value column, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the ImportSavedPasswords value name does not exist or its value data is not set to 0, then this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Import saved passwords from default browser on first run Policy State: Disabled Policy Value: N/A

  17. DTBC-0030 CAT II V-221578 · SRG-APP-000080

    Incognito mode must be disabled.

    Maps to AU-10 via CCI-000166
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If IncognitoModeAvailability is not displayed under the Policy Name column or it is not set to 1 under the Policy Value column, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the IncognitoModeAvailability value name does not exist or its value data is not set to 1, then this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Incognito mode availability Policy State: Enabled Policy Value: Incognito mode disabled

  18. DTBC-0037 CAT II V-221579 · SRG-APP-000605

    Online revocation checks must be performed.

    Maps to IA-5(2) via CCI-000185
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If EnableOnlineRevocationChecks is not displayed under the Policy Name column or it is not set to true under the Policy Value column, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the EnableOnlineRevocationChecks value name does not exist or its value data is not set to 1, then this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Enable online OCSP/CRL checks Policy State: Enabled Policy Value: N/A

  19. DTBC-0038 CAT II V-221580 · SRG-APP-000206

    Safe Browsing must be enabled.

    Maps to SC-18(1) via CCI-001166
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If SafeBrowsingProtectionLevel is not displayed under the Policy Name column or it is not set to 1 or 2 under the Policy Value column, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the SafeBrowsingProtectionLevel value name does not exist or its value data is not set to 1 or 2, then this is a finding.

    Fix

    Windows group policy: 1. Open the “group policy editor” tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Safe Browsing Settings Policy Name: Safe Browsing Protection Level Policy State: Enabled Policy Value: "(1) Safe Browsing is active in the standard mode", or "(2) Safe Browsing is active in the enhanced mode. This mode provides better security, but requires sharing more browsing information with Google".

  20. DTBC-0039 CAT II V-221581 · SRG-APP-000231

    Browser history must be saved.

    Maps to SC-28 via CCI-001199
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If the policy 'SavingBrowserHistoryDisabled' is not shown or is not set to false, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the SavingBrowserHistoryDisabled value name does not exist or its value data is not set to 0, then this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Disable saving browser history Policy State: Disabled Policy Value: N/A

  21. DTBC-0045 CAT II V-245539 · SRG-APP-000080

    Session only based cookies must be enabled.

    Maps to AU-10 via CCI-000166
    Check

    Universal method: 1. In the omnibox (address bar), type chrome://policy 2. If the policy "DefaultCookiesSetting" is not shown or is not set to "4", this is a finding. Windows method: 1. Start regedit. 2. Navigate to HKLM\Software\Policies\Google\Chrome\DefaultCookiesSetting. 3. If this key does not exist, or is not set to "4", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings. - Policy Name: Default cookies setting - Policy State: Enabled - Policy Value: Keep cookies for the duration of the session

  22. DTBC-0050 CAT II V-221584 · SRG-APP-000456

    The version of Google Chrome running on the system must be a supported version.

    Maps to SI-2 via CCI-002605
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://settings/help 2. Cross-reference the build information displayed with the Google Chrome site to identify, at minimum, the oldest supported build available. As of July 2019, this is 74.x.x. 3. If the installed version of Chrome is not supported by Google, this is a finding.

    Fix

    Install a supported version of Google Chrome.

  23. DTBC-0052 CAT II V-221586 · SRG-APP-000089

    Deletion of browser history must be disabled.

    Maps to AU-12 via CCI-000169
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If the policy "AllowDeletingBrowserHistory" is not shown or is not set to false, this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the "AllowDeletingBrowserHistory" value name does not exist or its value data is not set to "0", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Enable deleting browser and download history Policy State: Disabled Policy Value: N/A

  24. DTBC-0053 CAT II V-221587 · SRG-APP-000089

    Prompt for download location must be enabled.

    Maps to AU-12 via CCI-000169
    Check

    Universal method: 1. In the omnibox (address bar) type chrome:// policy 2. If "PromptForDownloadLocation" is not displayed under the "Policy Name" column or it is not set to "true" under the "Policy Value" column, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the "PromptForDownloadLocation" value name does not exist or its value data is not set to "1", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Ask where to save each file before downloading Policy State: Enabled Policy Value: N/A

  25. DTBC-0055 CAT II V-221588 · SRG-APP-000089

    Download restrictions must be configured.

    Maps to AU-12 via CCI-000169
    Check

    If the system is on the SIPRNet, this requirement is Not Applicable. Universal method: 1. In the omnibox (address bar) type "chrome:// policy". 2. If "DownloadRestrictions" is not displayed under the "Policy Name" column or it is set to "0", this is a finding. Windows method: 1. Start "regedit". 2. Navigate to "HKLM\Software\Policies\Google\Chrome\". 3. If the "DownloadRestrictions" value name does not exist or its value data is set to "0", this is a finding.

    Fix

    If the system is on the SIPRNet, this requirement is Not Applicable. Windows group policy: 1. Open the group policy editor tool with gpedit.msc. 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Allow download restrictions Policy State: 1, 2, or 4 Policy Value: N/A

  26. DTBC-0057 CAT II V-221590 · SRG-APP-000206

    Safe Browsing Extended Reporting must be disabled.

    Maps to SC-18(1) via CCI-001166
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If "SafeBrowsingExtendedReportingEnabled" is not displayed under the "Policy Name" column or it is not set to "False", this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the "SafeBrowsingExtendedReportingEnabled" value name does not exist or its value data is not set to "0", this is a finding.

    Fix

    Windows group policy: 1. Open the “group policy editor” tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Safe Browsing settings\ Policy Name: Enable Safe Browsing Extended Reporting Policy State: Disabled Policy Value: N/A

  27. DTBC-0058 CAT II V-221591 · SRG-APP-000141

    WebUSB must be disabled.

    Maps to CM-7 via CCI-000381
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If "DefaultWebUsbGuardSetting" is not displayed under the "Policy Name" column or it is not set to "2", this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the "DefaultWebUsbGuardSetting" value name does not exist or its value data is not set to "2", this is a finding.

    Fix

    Windows group policy: 1. Open the “group policy editor” tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings Policy Name: Control use of the WebUSB API Policy State: Enabled Policy Value: 2

  28. DTBC-0063 CAT II V-221594 · SRG-APP-000141

    Google Cast must be disabled.

    Maps to CM-7 via CCI-000381
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If "EnableMediaRouter" is not displayed under the "Policy Name" column or it is not set to "False", this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the "EnableMediaRouter" value name does not exist or its value data is not set to "0", this is a finding.

    Fix

    Windows group policy: 1. Open the “group policy editor” tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Google Cast Policy Name: Enable Google Cast Policy State: Disabled Policy Value: N/A

  29. DTBC-0064 CAT II V-221595 · SRG-APP-000141

    Autoplay must be disabled.

    Maps to CM-7 via CCI-000381
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If "AutoplayAllowed" is not displayed under the "Policy Name" column or it is not set to "False", this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the "AutoplayAllowed" value name does not exist or its value data is not set to "0", this is a finding.

    Fix

    Windows group policy: 1. Open the “group policy editor” tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Allow media autoplay Policy State: Disabled Policy Value: N/A

  30. DTBC-0065 CAT II V-221596 · SRG-APP-000210

    URLs must be allowlisted for Autoplay use.

    Maps to SC-18(4) via CCI-001170
    Check

    Universal method: 1. In the omnibox (address bar), type chrome://policy. 2. If “AutoplayAllowlist” under the “Policy Name” column may be set to a list of administrator-approved URLs under the “Policy Value” column. This requirement is optional. Windows method: 1. Start regedit. 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the “AutoplayAllowlist” key may contain a list of administrator-approved URLs. This requirement is optional.

    Fix

    Windows group policy: 1. Open the “group policy editor” tool with gpedit.msc. 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome - Policy Name: Allow media autoplay on a allowlist of URL patterns. - Policy State: Enabled - Policy Value 1: [*.]mil - Policy Value 2: [*.]gov Note: Policy values are examples.

  31. DTBC-0066 CAT II V-221597 · SRG-APP-000206

    Anonymized data collection must be disabled.

    Maps to SC-18(1) via CCI-001166
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If "UrlKeyedAnonymizedDataCollectionEnabled" is not displayed under the “Policy Name” column or it is not set to "0" under the “Policy Value” column, this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the “UrlKeyedAnonymizedDataCollectionEnabled" value name does not exist or its value data is not set to "0," this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Enable URL-keyed anonymized data collection Policy State: Disabled Policy Value: NA

  32. DTBC-0067 CAT II V-221598 · SRG-APP-000206

    Collection of WebRTC event logs must be disabled.

    Maps to SC-18(1) via CCI-001166
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If "WebRtcEventLogCollectionAllowed" is not displayed under the “Policy Name” column or it is not set to "0" under the “Policy Value” column, this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the "WebRtcEventLogCollectionAllowed" value name does not exist or its value data is not set to "0," this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Allow collection of WebRTC event logs from Google services Policy State: Disabled Policy Value: NA

  33. DTBC-0069 CAT II V-226401 · SRG-APP-000206

    Guest Mode must be disabled.

    Maps to SC-18(1) via CCI-001166
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If BrowserGuestModeEnabled is not displayed under the Policy Name column or it is not set to 0 under the Policy Value column, this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the BrowserGuestModeEnabled value name does not exist or its value data is not set to 0, this is a finding.

    Fix

    Windows group policy: 1. Open the "group policy editor" tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Enable guest mode in browser Policy State: Disabled

  34. DTBC-0070 CAT II V-226402 · SRG-APP-000206

    AutoFill for credit cards must be disabled.

    Maps to SC-18(1) via CCI-001166
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If AutofillCreditCardEnabled is not displayed under the Policy Name column or it is not set to 0 under the Policy Value column, this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the AutofillCreditCardEnabled value name does not exist or its value data is not set to 0, this is a finding.

    Fix

    Windows group policy: 1. Open the "group policy editor" tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Enable AutoFill for credit cards Policy State: Disabled

  35. DTBC-0071 CAT II V-226403 · SRG-APP-000206

    AutoFill for addresses must be disabled.

    Maps to SC-18(1) via CCI-001166
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If AutofillAddressEnabled is not displayed under the Policy Name column or it is not set to 0 under the Policy Value column, this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the AutofillAddressEnabled value name does not exist or its value data is not set to 0, this is a finding.

    Fix

    Windows group policy: 1. Open the "group policy editor" tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Enable AutoFill for addresses Policy State: Disabled

  36. DTBC-0072 CAT II V-226404 · SRG-APP-000206

    Import AutoFill form data must be disabled.

    Maps to SC-18(1) via CCI-001166
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If ImportAutofillFormData is not displayed under the Policy Name column or it is not set to 0 under the Policy Value column, this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the ImportAutofillFormData value name does not exist or its value data is not set to 0, this is a finding.

    Fix

    Windows group policy: 1. Open the "group policy editor" tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Import autofill form data from default browser on first run Policy State: Disabled

  37. DTBC-0073 CAT II V-241787 · SRG-APP-000141

    Web Bluetooth API must be disabled.

    Maps to CM-7 via CCI-000381
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If DefaultWebBluetoothGuardSetting is not displayed under the Policy Name column or it is not set to 2 under the Policy Value column, then this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the DefaultWebBluetoothGuardSetting value name does not exist or its value data is not set to 2, then this is a finding.

    Fix

    Windows group policy: 1. Open the “group policy editor” tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings Policy Name: Control use of the Web Bluetooth API Policy State: Enabled Policy Value: Do not allow any site to request access to Bluetooth devices via the Web Bluetooth API

  38. DTBC-0074 CAT II V-245538 · SRG-APP-000383

    Use of the QUIC protocol must be disabled.

    Maps to CM-7(1) via CCI-001762
    Check

    Universal method: 1. In the omnibox (address bar), type chrome://policy. 2. If QuicAllowed is not displayed under the Policy Name column or it is not set to False under the Policy Value column, this is a finding. Windows method: 1. Start regedit. 2. Navigate to HKLM\Software\Policies\Google\Chrome\. 3. If the QuicAllowed value name does not exist or its value data is not set to 0, this is a finding.

    Fix

    Windows group policy: 1. Open the “group policy editor” tool with gpedit.msc. 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google Chrome. - Policy Name: Allow QUIC protocol - Policy State: Disabled - Policy Value: N/A

  39. DTBC-0075 CAT II V-275780 · SRG-APP-000089

    Create Themes with AI must be disabled.

    Maps to AU-12 via CCI-000169
    Check

    Universal method: 1. In the omnibox (address bar) type "chrome:// policy". 2. If "CreateThemesSettings" is not displayed under the "Policy Name" column or it is not set to "2" under the "Policy Value" column, this is a finding. Windows method: 1. Start "regedit". 2. Navigate to "HKLM\Software\Policies\Google\Chrome\". 3. If the "CreateThemesSettings" value name does not exist or its value data is not set to "2", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc. 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Generative AI Policy Name: Settings for Create Themes with AI Policy State: Enabled Policy Value: Do not allow Create Themes

  40. DTBC-0076 CAT II V-275781 · SRG-APP-000089

    DevTools Generative AI features must be disabled.

    Maps to AU-12 via CCI-000169
    Check

    Universal method: 1. In the omnibox (address bar) type "chrome:// policy". 2. If "DevToolsGenAiSettings" is not displayed under the "Policy Name" column or it is not set to "2" under the "Policy Value" column, this is a finding. Windows method: 1. Start "regedit". 2. Navigate to "HKLM\Software\Policies\Google\Chrome\". 3. If the "DevToolsGenAiSettings" value name does not exist or its value data is not set to "2", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc. 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Generative AI Policy Name: Settings for DevTools Generative AI Features Policy State: Enabled Policy Value: Do not allow DevTools Generative AI Features

  41. DTBC-0077 CAT II V-275782 · SRG-APP-000089

    GenAI local foundational model must be disabled.

    Maps to AU-12 via CCI-000169
    Check

    Universal method: 1. In the omnibox (address bar) type "chrome:// policy". 2. If "GenAILocalFoundationalModelSettings" is not displayed under the "Policy Name" column or it is not set to "1" under the "Policy Value" column, this is a finding. Windows method: 1. Start "regedit". 2. Navigate to "HKLM\Software\Policies\Google\Chrome\". 3. If the "GenAILocalFoundationalModelSettings" value name does not exist or its value data is not set to "1", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc. 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Generative AI Policy Name: Settings for GenAI local foundational model Policy State: Enabled Policy Value: Do not download model

  42. DTBC-0078 CAT II V-275783 · SRG-APP-000089

    Help Me Write must be disabled.

    Maps to AU-12 via CCI-000169
    Check

    Universal method: 1. In the omnibox (address bar) type "chrome:// policy". 2. If "HelpMeWriteSettings" is not displayed under the "Policy Name" column or it is not set to "2" under the "Policy Value" column, this is a finding. Windows method: 1. Start "regedit". 2. Navigate to "HKLM\Software\Policies\Google\Chrome\". 3. If the "HelpMeWriteSettings" value name does not exist or its value data is not set to "2", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc. 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Generative AI Policy Name: Settings forSettings for Help Me Write Policy State: Enabled Policy Value: Do not allow Help Me Write

  43. DTBC-0079 CAT II V-275784 · SRG-APP-000089

    AI-powered History Search must be disabled.

    Maps to AU-12 via CCI-000169
    Check

    Universal method: 1. In the omnibox (address bar) type "chrome:// policy". 2. If "HistorySearchSettings" is not displayed under the "Policy Name" column or it is not set to "2" under the "Policy Value" column, this is a finding. Windows method: 1. Start "regedit". 2. Navigate to "HKLM\Software\Policies\Google\Chrome\". 3. If the "HistorySearchSettings" value name does not exist or its value data is not set to "2", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc. 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Generative AI Policy Name: Settings for AI-powered History Search Policy State: Enabled Policy Value: Do not allow AI History Search

  44. DTBC-0080 CAT II V-275785 · SRG-APP-000089

    Tab Compare Settings must be disabled.

    Maps to AU-12 via CCI-000169
    Check

    Universal method: 1. In the omnibox (address bar) type "chrome:// policy". 2. If "TabCompareSettings" is not displayed under the "Policy Name" column or it is not set to "2" under the "Policy Value" column, this is a finding. Windows method: 1. Start "regedit". 2. Navigate to "HKLM\Software\Policies\Google\Chrome\". 3. If the "TabCompareSettings" value name does not exist or its value data is not set to "2", this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc. 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Generative AI Policy Name: Tab Compare settings Policy State: Enabled Policy Value: Do not allow Tab Compare

CAT III 2

Any vulnerability, the existence of which degrades measures to protect against loss of confidentiality, availability or integrity.

  1. DTBC-0006 CAT III V-221563 · SRG-APP-000210

    Extensions that are approved for use must be allowlisted.

    Maps to SC-18(4) via CCI-001170
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If ExtensionInstallAllowlist is not displayed under the Policy Name column or it is not set to oiigbmnaadbkfbmpbfijlflahbdbdgdf or a list of administrator approved extension IDs, then this is a finding. Windows method: 1. Start regedit 2. Navigate to the key HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist 3. If the ExtensionInstallAllowlist key is not set to 1 and oiigbmnaadbkfbmpbfijlflahbdbdgdf or a list of administrator-approved extension IDs, then this is a finding.

    Fix

    Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Extensions\ Policy Name: Configure extension installation allowlist Policy State: Enabled Policy Value: oiigbmnaadbkfbmpbfijlflahbdbdgdf Note: oiigbmnaadbkfbmpbfijlflahbdbdgdfis the extension ID for scriptno (a commonly used Chrome extension), other extension IDs may vary.

  2. DTBC-0068 CAT III V-221599 · SRG-APP-000266

    Chrome development tools must be disabled.

    Maps to SI-11 via CCI-001312
    Check

    Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If the policy "DeveloperToolsAvailability" is not shown or is not set to "2", this is a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the key "DeveloperToolsAvailability" does not exist or is not set to "2", this is a finding.

    Fix

    Windows group policy: 1. Open the "group policy editor" tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome Policy Name: Control where Developer Tools can be used Policy State: Enabled Policy Value: Disallow usage of the Developer Tools