UCF STIG Viewer Logo

Chrome Cleanup reporting must be disabled.


Overview

Finding ID Version Rule ID IA Controls Severity
V-221593 DTBC-0061 SV-221593r615937_rule Medium
Description
If unset, should Chrome Cleanup detect unwanted software, it may report metadata about the scan to Google in accordance with policy set by “SafeBrowsingExtendedReportingEnabled”. Chrome Cleanup will then ask the user if they wish to clean up the unwanted software. The user can choose to share results of the cleanup with Google to assist with future unwanted software detection. These results contain file metadata and registry keys as described by the Chrome Privacy Whitepaper. If set to “false”, should Chrome Cleanup detect unwanted software, it will not report metadata about the scan to Google, overriding any policy set by “SafeBrowsingExtendedReportingEnabled”. Chrome Cleanup will ask the user if they wish to clean up the unwanted software. Results of the cleanup will not be reported to Google and the user will not have the option to do so. If set to “true”, should Chrome Cleanup detect unwanted software, it may report metadata about the scan to Google in accordance with policy set by “SafeBrowsingExtendedReportingEnabled”. Chrome Cleanup will ask the user if they wish to clean up the unwanted software. Results of the cleanup will be reported to Google and the user will not have the option to prevent it. This policy is available only on Windows instances that are joined to a Microsoft Active Directory domain.
STIG Date
Google Chrome Current Windows Security Technical Implementation Guide 2022-09-09

Details

Check Text ( C-23308r415906_chk )
Universal method:
1. In the omnibox (address bar) type chrome://policy
2. If "ChromeCleanupReportingEnabled" is not displayed under the "Policy Name" column or it is not set to "False", this is a finding.
Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the "ChromeCleanupReportingEnabled" value name does not exist or its value data is not set to "0", this is a finding.
Fix Text (F-23297r415907_fix)
Windows group policy:
1. Open the “group policy editor” tool with gpedit.msc
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome
Policy Name: Control how Chrome Cleanup reports data to Google
Policy State: Disabled
Policy Value: N/A