CIS Brave Browser Benchmark

This recommendation verifies that Shields defaults are set to Aggressive blocking on the Brave Browser web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Brave Browser web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Shields defaults:
# brave://settings/shields

# Verify via policies (managed):
# Windows: HKLM\SOFTWARE\Policies\BraveSoftware\Brave
# Linux:
cat /etc/brave/policies/managed/brave_policy.json 2>/dev/null

# macOS:
defaults read /Library/Managed\ Preferences/com.brave.Browser 2>/dev/null

# Configure Shields defaults via enterprise policy:
mkdir -p /etc/brave/policies/managed
cat > /etc/brave/policies/managed/brave_policy.json << 'POLICY'
{
  "DefaultShieldsSetting": 1,
  "AdsBlocking": "aggressive",
  "TrackersBlocking": "aggressive",
  "FingerprintingBlocking": "strict"
}
POLICY

# Manual: brave://settings/shields
# Trackers & ads blocking: Aggressive
# Upgrade connections to HTTPS: Enabled
# Block scripts: Consider per-site
# Block fingerprinting: Strict

This setting ensures that third-party cookies are blocked with session-only exceptions on the Brave Browser web browser. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Brave Browser web browser is essential for defense in depth.

# Check cookie settings:
# brave://settings/cookies

# Check policy:
grep -i cookie /etc/brave/policies/managed/brave_policy.json 2>/dev/null

# Configure strict cookie policy:
cat > /etc/brave/policies/managed/cookie_policy.json << 'POLICY'
{
  "DefaultCookiesSetting": 4,
  "BlockThirdPartyCookies": true,
  "CookiesSessionOnlyForUrls": ["[*.]example.com"],
  "CookiesBlockedForUrls": ["[*.]tracking.com"]
}
POLICY

# Manual: brave://settings/cookies
# Block third-party cookies: Enabled
# Clear cookies and site data on exit: Enabled
# Send 'Do Not Track': Enabled

This recommendation verifies that WebRTC IP leak is disabled for non-proxied UDP on the Brave Browser web browser. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Brave Browser web browser increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check WebRTC policy:
# brave://settings/privacy
# Look for 'WebRTC IP handling policy'

# Check policy file:
grep -i webrtc /etc/brave/policies/managed/brave_policy.json 2>/dev/null

# Verify in browser:
# Visit brave://webrtc-internals/

# Disable WebRTC IP leak:
cat > /etc/brave/policies/managed/webrtc_policy.json << 'POLICY'
{
  "WebRtcIPHandling": "disable_non_proxied_udp",
  "WebRtcLocalIpsAllowedUrls": [],
  "WebRtcUdpPortRange": "10000-10010"
}
POLICY

# Manual: brave://settings/privacy
# WebRTC IP handling policy: Disable non-proxied UDP

# For maximum privacy:
# brave://flags/#enable-webrtc-hide-local-ips-with-mdns → Enabled

This recommendation verifies that strict fingerprinting protection is enabled on the Brave Browser web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Brave Browser web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check fingerprinting protection:
# brave://settings/shields

# Test fingerprinting:
# Visit https://coveryourtracks.eff.org/

# Policy check:
grep -i fingerprint /etc/brave/policies/managed/brave_policy.json 2>/dev/null

# Enable strict fingerprinting protection:
cat > /etc/brave/policies/managed/fingerprint_policy.json << 'POLICY'
{
  "FingerprintingBlocking": "strict",
  "BraveShieldsDefaultFingerprinting": "block"
}
POLICY

# Manual: brave://settings/shields
# Block fingerprinting: Strict, may break sites

# Additional flags:
# brave://flags/#brave-adblock-cname-uncloaking → Enabled
# brave://flags/#brave-dark-mode-block → Enabled

This setting ensures that extension installation is restricted to an allowlist on the Brave Browser web browser. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Brave Browser web browser is essential for defense in depth.

# List installed extensions:
# brave://extensions/

# Check extension policies:
grep -i extension /etc/brave/policies/managed/brave_policy.json 2>/dev/null

# Check extension permissions:
# Click each extension > Details > Site access

# Control extensions via policy:
cat > /etc/brave/policies/managed/extension_policy.json << 'POLICY'
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "cjpalhdlnbpafiamejdnhcphjbkeiagm",
    "dbepggeogbaibhgnhhndojpepiihcmeb"
  ],
  "ExtensionInstallForcelist": [],
  "ExtensionAllowedTypes": ["extension"],
  "BlockExternalExtensions": true
}
POLICY

# Manual review:
# 1. Remove unused extensions
# 2. Review permissions for each extension
# 3. Disable 'Allow in Incognito' unless needed
# 4. Set site access to 'On click' not 'On all sites'

This recommendation verifies that camera, microphone, and location permissions default to block on the Brave Browser web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Brave Browser web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check content settings:
# brave://settings/content

# Verify media permissions:
# brave://settings/content/camera
# brave://settings/content/microphone
# brave://settings/content/location

# Restrict content and permission settings:
cat > /etc/brave/policies/managed/content_policy.json << 'POLICY'
{
  "DefaultGeolocationSetting": 2,
  "DefaultNotificationsSetting": 2,
  "DefaultPopupsSetting": 2,
  "DefaultJavaScriptJitSetting": 2,
  "VideoCaptureAllowed": false,
  "AudioCaptureAllowed": false,
  "DefaultSensorsSetting": 2,
  "DefaultSerialGuardSetting": 2,
  "DefaultWebBluetoothGuardSetting": 2,
  "DefaultWebUsbGuardSetting": 2
}
POLICY

# Manual: brave://settings/content
# Location: Block
# Camera: Block (allow per-site)
# Microphone: Block (allow per-site)
# Notifications: Block
# JavaScript JIT: Block (brave://settings/content/v8)

This recommendation ensures that HTTPS-Only mode is enforced for all connections on the Brave Browser web browser. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Brave Browser web browser may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check HTTPS settings:
# brave://settings/shields
# Look for: Upgrade connections to HTTPS

# Check policy:
grep -iE 'https|hsts' /etc/brave/policies/managed/brave_policy.json 2>/dev/null

# Enforce HTTPS-Only mode:
cat > /etc/brave/policies/managed/https_policy.json << 'POLICY'
{
  "HttpsOnlyMode": "force_enabled",
  "HttpsUpgradesEnabled": true,
  "HSTSPolicyBypassList": []
}
POLICY

# Manual: brave://settings/shields
# Upgrade connections to HTTPS: Strict

# Additional: brave://flags/
# #https-upgrades → Enabled
# #https-first-mode-v2 → Enabled

This recommendation verifies that DNS-over-HTTPS is configured with a trusted resolver on the Brave Browser web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Brave Browser web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check DNS settings:
# brave://settings/security
# Look for: Use secure DNS

# Verify DNS provider:
# brave://net-internals/#dns

# Configure secure DNS:
cat > /etc/brave/policies/managed/dns_policy.json << 'POLICY'
{
  "DnsOverHttpsMode": "secure",
  "DnsOverHttpsTemplates": "https://dns.quad9.net/dns-query",
  "BuiltInDnsClientEnabled": true
}
POLICY

# Manual: brave://settings/security
# Use secure DNS: Enabled
# Provider: Quad9 (or Cloudflare for Families)
# Custom: https://dns.quad9.net/dns-query

This recommendation verifies that Brave Sync excludes passwords and autofill data on the Brave Browser web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Brave Browser web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Brave Sync status:
# brave://settings/braveSync

# Check sync categories:
# brave://settings/braveSync/setup

# Verify encryption:
# Look for sync code / passphrase status

# Configure Brave Sync securely:
# 1. Navigate to brave://settings/braveSync
# 2. Start a new sync chain or join existing
# 3. Record the sync code securely (password manager)
# 4. Select only necessary categories:
#    - Bookmarks: Yes
#    - Extensions: Yes (if same on all devices)
#    - History: Optional (privacy consideration)
#    - Passwords: No (use dedicated password manager)
#    - Open tabs: No

# Policy to restrict sync:
cat > /etc/brave/policies/managed/sync_policy.json << 'POLICY'
{
  "SyncDisabled": false,
  "BraveSyncUrl": "",
  "SyncTypesListDisabled": ["passwords", "autofill"]
}
POLICY

This recommendation verifies that built-in password manager is disabled in favor of a dedicated tool on the Brave Browser web browser. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Brave Browser web browser increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check password manager settings:
# brave://settings/passwords

# Check autofill:
# brave://settings/autofill

# Check policy:
grep -iE 'password|autofill' /etc/brave/policies/managed/brave_policy.json 2>/dev/null

# Disable built-in password manager (use external):
cat > /etc/brave/policies/managed/password_policy.json << 'POLICY'
{
  "PasswordManagerEnabled": false,
  "AutofillCreditCardEnabled": false,
  "AutofillAddressEnabled": false,
  "PasswordLeakDetectionEnabled": true,
  "ImportSavedPasswords": false
}
POLICY

# Manual: brave://settings/passwords
# Offer to save passwords: Disabled
# Auto sign-in: Disabled
# Payment methods > Save and fill payment methods: Disabled
# Addresses > Save and fill addresses: Disabled

# Use a dedicated password manager extension instead

This recommendation verifies that P3A analytics, crash reporting, and Brave Rewards are disabled on the Brave Browser web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Brave Browser web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check telemetry settings:
# brave://settings/privacy
# Look for: Usage statistics, crash reports

# Check Brave rewards:
# brave://rewards/

# Policy check:
grep -iE 'telemetry|crash|p3a' /etc/brave/policies/managed/brave_policy.json 2>/dev/null

# Disable telemetry and analytics:
cat > /etc/brave/policies/managed/telemetry_policy.json << 'POLICY'
{
  "P3AEnabled": false,
  "MetricsReportingEnabled": false,
  "CrashReportingEnabled": false,
  "StatsReportingEnabled": false,
  "BraveRewardsDisabled": true,
  "BraveWalletDisabled": true,
  "BraveVPNDisabled": true,
  "BraveNewsEnabled": false,
  "TorDisabled": false
}
POLICY

# Manual: brave://settings/privacy
# Allow privacy-preserving product analytics (P3A): Disabled
# Automatically send daily usage ping: Disabled
# Automatically send diagnostic reports: Disabled

This recommendation verifies that privacy-respecting default search engine is configured on the Brave Browser web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Brave Browser web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check search engine settings:
# brave://settings/search

# Check default search:
# brave://settings/searchEngines

# Verify autocomplete behavior:
# Type in address bar → check suggestions source

# Configure private search defaults:
cat > /etc/brave/policies/managed/search_policy.json << 'POLICY'
{
  "DefaultSearchProviderEnabled": true,
  "DefaultSearchProviderName": "Brave Search",
  "DefaultSearchProviderSearchURL": "https://search.brave.com/search?q={searchTerms}",
  "DefaultSearchProviderSuggestURL": "https://search.brave.com/api/suggest?q={searchTerms}",
  "SearchSuggestEnabled": false,
  "AlternateErrorPagesEnabled": false
}
POLICY

# Manual: brave://settings/search
# Default search engine: Brave Search
# Autocomplete searches: Disabled or Brave only
# Improve search suggestions: Disabled

This recommendation verifies that Tor window usage follows anonymity best practices on the Brave Browser web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Brave Browser web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Tor window configuration:
# Open Brave > New Private Window with Tor
# Check: brave://settings/privacy

# Policy check:
grep -i tor /etc/brave/policies/managed/brave_policy.json 2>/dev/null

# Configure Tor window settings:
# Policy:
cat > /etc/brave/policies/managed/tor_policy.json << 'POLICY'
{
  "TorDisabled": false
}
POLICY

# Manual guidance:
# 1. Only use Tor window for sensitive browsing
# 2. Do NOT log in to personal accounts in Tor window
# 3. Do NOT maximize Tor window (fingerprinting)
# 4. Do NOT install extensions for Tor window
# 5. Enable 'Block scripts' in Shields for Tor
# 6. Close Tor window fully when done

# Note: For stronger anonymity,
# use dedicated Tor Browser instead

This recommendation verifies that automatic browser and component updates are enabled on the Brave Browser web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Brave Browser web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check browser update settings:
# brave://settings/help
# Check current version against latest release

# Policy check:
grep -i update /etc/brave/policies/managed/brave_policy.json 2>/dev/null

# Linux package manager:
apt list --installed 2>/dev/null | grep brave
dnf list installed 2>/dev/null | grep brave

# Ensure automatic updates are enabled:
cat > /etc/brave/policies/managed/update_policy.json << 'POLICY'
{
  "BrowserSignin": 0,
  "ComponentUpdatesEnabled": true,
  "RelaunchNotification": 2,
  "RelaunchNotificationPeriod": 86400000
}
POLICY

# Linux: Ensure repo is configured:
cat > /etc/apt/sources.list.d/brave-browser.list << 'REPO'
deb [signed-by=/usr/share/keyrings/brave-browser-archive-keyring.gpg] https://brave-browser-apt-release.s3.brave.com/ stable main
REPO

# Enable unattended updates:
apt update && apt install -y unattended-upgrades
echo 'Unattended-Upgrade::Allowed-Origins { "Brave Browser"; };' \
  >> /etc/apt/apt.conf.d/50unattended-upgrades