CIS Google Chrome Benchmark

This setting ensures that Extension Installation is restricted on the Google Chrome web browser. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted Extension Installation could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Google Chrome web browser is essential for defense in depth.

# Registry (Windows):
HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist
# Should have value "*" to block all by default

# chrome://policy — check ExtensionInstallBlocklist

# Group Policy: Computer Configuration → Administrative Templates → Google Chrome → Extensions
# → Configure extension installation blocklist → Enabled → Add "*"

# Or via managed JSON policy:
{
  "ExtensionInstallBlocklist": ["*"]
}

This recommendation verifies that Approved Extensions Are Allowlisted on the Google Chrome web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to approved Extensions Are Allowlisted may leave the Google Chrome web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Registry (Windows):
HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist

# chrome://policy — check ExtensionInstallAllowlist

# Add only approved extension IDs to the allowlist:
{
  "ExtensionInstallAllowlist": [
    "extension_id_1",
    "extension_id_2"
  ]
}

This setting ensures that Extension Permissions is controlled on the Google Chrome web browser. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted Extension Permissions could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Google Chrome web browser is essential for defense in depth.

# chrome://policy — check ExtensionSettings

{
  "ExtensionSettings": {
    "*": {
      "blocked_permissions": ["clipboardRead", "geolocation"],
      "installation_mode": "blocked"
    }
  }
}

This recommendation verifies that Outdated Plugins Are Blocked on the Google Chrome web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to outdated Plugins Are Blocked may leave the Google Chrome web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# chrome://policy — check AllowOutdatedPlugins
# Should be Disabled or Not Configured

{
  "AllowOutdatedPlugins": false
}

This setting controls whether Safe Browsing is enabled on the Google Chrome web browser. Enabling this feature strengthens the security posture by enforcing the recommended configuration via Group Policy, Chrome Enterprise policies, or managed preferences.

Without Safe Browsing enabled, the Google Chrome web browser may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

# chrome://policy — check SafeBrowsingEnabled
# Should be true

{
  "SafeBrowsingEnabled": true
}

This setting controls whether Enhanced Safe Browsing is enabled on the Google Chrome web browser. Enabling this feature strengthens the security posture by enforcing the recommended configuration via Group Policy, Chrome Enterprise policies, or managed preferences.

Without Enhanced Safe Browsing enabled, the Google Chrome web browser may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

# chrome://policy — check SafeBrowsingProtectionLevel
# Should be 2 (Enhanced Protection)

{
  "SafeBrowsingProtectionLevel": 2
}

This recommendation verifies that Users Cannot Override Safe Browsing on the Google Chrome web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to users Cannot Override Safe Browsing may leave the Google Chrome web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# chrome://policy — check DisableSafeBrowsingProceedAnyway

{
  "DisableSafeBrowsingProceedAnyway": true
}

This recommendation verifies that Third-Party Cookies Are Blocked on the Google Chrome web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to third-Party Cookies Are Blocked may leave the Google Chrome web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# chrome://policy — check BlockThirdPartyCookies

{
  "BlockThirdPartyCookies": true
}

This setting controls whether Site Isolation is enabled on the Google Chrome web browser. Enabling this feature strengthens the security posture by enforcing the recommended configuration via Group Policy, Chrome Enterprise policies, or managed preferences.

Without Site Isolation enabled, the Google Chrome web browser may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

# chrome://policy — check SitePerProcess
# Should be Enabled

{
  "SitePerProcess": true
}

This setting controls whether Do Not Track is enabled on the Google Chrome web browser. Enabling this feature strengthens the security posture by enforcing the recommended configuration via Group Policy, Chrome Enterprise policies, or managed preferences.

Without Do Not Track enabled, the Google Chrome web browser may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

# chrome://policy — check EnableDoNotTrack

{
  "EnableDoNotTrack": true
}

This recommendation verifies that Minimum TLS Version Is 1.2 on the Google Chrome web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to minimum TLS Version Is 1.2 may leave the Google Chrome web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# chrome://policy — check SSLVersionMin
# Should be "tls1.2"

{
  "SSLVersionMin": "tls1.2"
}

This recommendation verifies that Certificate Transparency Is Enforced on the Google Chrome web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to certificate Transparency Is Enforced may leave the Google Chrome web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# chrome://policy — check CertificateTransparencyEnforcementDisabledForUrls
# Should be empty or Not Configured

# Do not add URLs to the Certificate Transparency bypass list
# Ensure CertificateTransparencyEnforcementDisabledForUrls is not set

This setting controls whether DNS-over-HTTPS is enabled on the Google Chrome web browser. Enabling this feature strengthens the security posture by enforcing the recommended configuration via Group Policy, Chrome Enterprise policies, or managed preferences.

Without DNS-over-HTTPS enabled, the Google Chrome web browser may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

# chrome://policy — check DnsOverHttpsMode
# Should be "automatic" or "secure"

{
  "DnsOverHttpsMode": "automatic"
}

This recommendation addresses the proper configuration of Proxy Settings on the Google Chrome web browser. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Proxy Settings can lead to security gaps that may be exploited by attackers. A properly configured Google Chrome web browser reduces exposure to both known vulnerabilities and configuration drift.

# chrome://policy — check ProxyMode, ProxyServer, ProxyPacUrl

{
  "ProxyMode": "pac_script",
  "ProxyPacUrl": "https://proxy.example.com/proxy.pac"
}

This recommendation verifies that Pop-ups Are Blocked by Default on the Google Chrome web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to pop-ups Are Blocked by Default may leave the Google Chrome web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# chrome://policy — check DefaultPopupsSetting
# Should be 2 (Do not allow any site to show pop-ups)

{
  "DefaultPopupsSetting": 2
}

This recommendation verifies that Geolocation Access Requires User Consent on the Google Chrome web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to geolocation Access Requires User Consent may leave the Google Chrome web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# chrome://policy — check DefaultGeolocationSetting
# Should be 3 (Do not allow any site to track physical location)

{
  "DefaultGeolocationSetting": 3
}

This recommendation addresses the proper configuration of Download Restrictions on the Google Chrome web browser. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Download Restrictions can lead to security gaps that may be exploited by attackers. A properly configured Google Chrome web browser reduces exposure to both known vulnerabilities and configuration drift.

# chrome://policy — check DownloadRestrictions
# Should be 1 (Block dangerous downloads) or higher

{
  "DownloadRestrictions": 1
}

This recommendation verifies that Download Directory Is Specified on the Google Chrome web browser. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to download Directory Is Specified may leave the Google Chrome web browser vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# chrome://policy — check DownloadDirectory

{
  "DownloadDirectory": "${user_home}/Downloads"
}

This setting controls whether Built-in Password Manager is disabled on the Google Chrome web browser. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving Built-in Password Manager enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Google Chrome web browser.

# chrome://policy — check PasswordManagerEnabled
# Should be false when using enterprise password manager

{
  "PasswordManagerEnabled": false
}

This setting controls whether Password Leak Detection is enabled on the Google Chrome web browser. Enabling this feature strengthens the security posture by enforcing the recommended configuration via Group Policy, Chrome Enterprise policies, or managed preferences.

Without Password Leak Detection enabled, the Google Chrome web browser may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

# chrome://policy — check PasswordLeakDetectionEnabled

{
  "PasswordLeakDetectionEnabled": true
}

This setting controls whether Autofill for Addresses is disabled on the Google Chrome web browser. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving Autofill for Addresses enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Google Chrome web browser.

# chrome://policy — check AutofillAddressEnabled

{
  "AutofillAddressEnabled": false
}

This setting controls whether Autofill for Payment Methods is disabled on the Google Chrome web browser. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving Autofill for Payment Methods enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Google Chrome web browser.

# chrome://policy — check AutofillCreditCardEnabled

{
  "AutofillCreditCardEnabled": false
}

This setting controls whether Auto-Update is enabled on the Google Chrome web browser. Enabling this feature strengthens the security posture by enforcing the recommended configuration via Group Policy, Chrome Enterprise policies, or managed preferences.

Without Auto-Update enabled, the Google Chrome web browser may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

# Windows Registry:
HKLM\SOFTWARE\Policies\Google\Update\UpdateDefault
# Should be 1 (Always allow updates)

# chrome://settings/help — Check update status

# Group Policy: Computer Configuration → Administrative Templates → Google Update
# → Applications → Google Chrome → Update policy override → Always allow updates

This recommendation addresses the proper configuration of Relaunch Notification on the Google Chrome web browser. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Relaunch Notification can lead to security gaps that may be exploited by attackers. A properly configured Google Chrome web browser reduces exposure to both known vulnerabilities and configuration drift.

# chrome://policy — check RelaunchNotification

{
  "RelaunchNotification": 2,
  "RelaunchNotificationPeriod": 604800000
}

This setting controls whether Usage Reporting is disabled on the Google Chrome web browser. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving Usage Reporting enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Google Chrome web browser.

# chrome://policy — check MetricsReportingEnabled
# Should be false

{
  "MetricsReportingEnabled": false
}

This setting controls whether Spell Check Data Sharing is disabled on the Google Chrome web browser. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving Spell Check Data Sharing enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Google Chrome web browser.

# chrome://policy — check SpellCheckServiceEnabled

{
  "SpellCheckServiceEnabled": false
}