3D Graphics APIs must be disabled.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-44757	DTBC-0019	SV-57591r3_rule		Medium

Description
Disable support for 3D graphics APIs. Enabling this setting prevents web pages from accessing the graphics processing unit (GPU). Specifically, web pages cannot access the WebGL API and plugins cannot use the Pepper 3D API. Disabling this setting or leaving it not set potentially allows web pages to use the WebGL API and plugins to use the Pepper 3D API. The default settings of the browser may still require command line arguments to be passed in order to use these APIs. Chrome uses WebGL to render graphics using the GPU. There are few sites that currently take advantage of this feature. Since there is unlikely to be an operational impact, it is recommended that this feature is turned off in order to reduce the attack surface.

Description

Disable support for 3D graphics APIs. Enabling this setting prevents web pages from accessing the graphics processing unit (GPU). Specifically, web pages cannot access the WebGL API and plugins cannot use the Pepper 3D API. Disabling this setting or leaving it not set potentially allows web pages to use the WebGL API and plugins to use the Pepper 3D API. The default settings of the browser may still require command line arguments to be passed in order to use these APIs. Chrome uses WebGL to render graphics using the GPU. There are few sites that currently take advantage of this feature. Since there is unlikely to be an operational impact, it is recommended that this feature is turned off in order to reduce the attack surface.

STIG	Date
Google Chrome Current Windows Security Technical Implementation Guide	2019-10-04

Details

Check Text ( C-49539r4_chk )
Universal method: 1. In the omnibox (address bar) type chrome://policy 2. If "Disable3DAPIs" is not displayed under the Policy Name column or it is not set to true under the Policy Value column, this is a finding. Note: If WebGL APIs are required by mission, this is not a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the "Disable3DAPIs" value name does not exist or its value data is not set to "1", this is a finding. Note: If WebGL APIs are required by mission, this is not a finding.

Check Text ( C-49539r4_chk )

Universal method:
1. In the omnibox (address bar) type chrome://policy
2. If "Disable3DAPIs" is not displayed under the Policy Name column or it is not set to true under the Policy Value column, this is a finding.
Note: If WebGL APIs are required by mission, this is not a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the "Disable3DAPIs" value name does not exist or its value data is not set to "1", this is a finding.
Note: If WebGL APIs are required by mission, this is not a finding.

Fix Text (F-49849r3_fix)
Windows group policy: 1. Open the group policy editor tool with gpedit.msc 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Disable support for 3D graphics APIs Policy State: Enabled Policy Value: N/A