STIGQter: STIG Summary: Google Chrome Current Windows Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

Extensions that are approved for use must be allowlisted.

DISA Rule

SV-221563r684818_rule

Vulnerability Number

V-221563

Group Title

SRG-APP-000210

Rule Version

DTBC-0006

Severity

CAT II

CCI(s)

• CCI-001170 - The information system prevents the automatic execution of mobile code in organization-defined software applications.

Weight

10

Fix Recommendation

Windows group policy:
1. Open the group policy editor tool with gpedit.msc
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\Extensions\
Policy Name: Configure extension installation allowlist
Policy State: Enabled
Policy Value: oiigbmnaadbkfbmpbfijlflahbdbdgdf

Note: oiigbmnaadbkfbmpbfijlflahbdbdgdfis the extension ID for scriptno (a commonly used Chrome extension), other extension IDs may vary.

Check Contents

Universal method:
1. In the omnibox (address bar) type chrome://policy
2. If ExtensionInstallAllowlist is not displayed under the Policy Name column or it is not set to oiigbmnaadbkfbmpbfijlflahbdbdgdf or a list of administrator approved extension IDs, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to the key HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist
3. If the ExtensionInstallAllowlist key is not set to 1 and oiigbmnaadbkfbmpbfijlflahbdbdgdf or a list of administrator-approved extension IDs, then this is a finding.

Vulnerability Number

V-221563

Documentable

False

Rule Version

DTBC-0006

Severity Override Guidance

Universal method:
1. In the omnibox (address bar) type chrome://policy
2. If ExtensionInstallAllowlist is not displayed under the Policy Name column or it is not set to oiigbmnaadbkfbmpbfijlflahbdbdgdf or a list of administrator approved extension IDs, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to the key HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist
3. If the ExtensionInstallAllowlist key is not set to 1 and oiigbmnaadbkfbmpbfijlflahbdbdgdf or a list of administrator-approved extension IDs, then this is a finding.

Check Content Reference

M

Target Key

4081

Comments