UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The URL protocol schemas file and javascript must be disabled


Overview

Finding ID Version Rule ID IA Controls Severity
V-35771 DTBC-0021 SV-47058r2_rule ECSC-1 High
Description
"Disables the listed protocol schemes in Google Chrome. URLs using a scheme from this list will not load and can not be navigated to. If this policy is left not set or the list is empty all schemes will be accessible in Google Chrome." - Google Chrome Administrators Policy List
STIG Date
Google Chrome v24 Windows Benchmark 2013-03-07

Details

Check Text ( http://oval.mitre.org/XMLSchema/oval-definitions-5 )
Universal method (Requires Chrome Browser v15 or later):
1. In the omnibox (address bar) type chrome://policy
2. If DisabledSchemes is not displayed under the Policy Name column or it is not set to file,javascript under the Policy Value column, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\DisabledSchemes
3. If the DisabledSchemes key does not exist, or the does not cantain entries 1 and 2 set to file and javascript, then this is a finding.
Fix Text (F-40318r1_fix)
Valid for Chrome Browser version 12 or later.

Windows registry:
Key Path: HKLM\Software\Policies\Google\Chrome\DisabledSchemes\
Value Name: 1
Value Type: String (REG_SZ)
Value Data: file

Key Path: HKLM\Software\Policies\Google\Chrome\DisabledSchemes\
Value Name: 2
Value Type: String (REG_SZ)
Value Data: javascript

Windows group policy:
Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
Policy Name: Disable URL protocol schemes
Policy State: Enabled
Policy Value 1: file
Policy Value 2: javascript