documentation_complete: true

title: 'Disable All Extensions by Default'

description: "Extensions are developed by third party sources and are designed to extend \nGoogle Chromium's functionality. As an extension can be made by anyone, all extensions\nshould be blacklisted from installation by default. To blacklist all extensions, set the \n<tt>ExtensionInstallBlacklist</tt> to <tt>*</tt> in the Chromium policy file."

rationale: |-
    Extensions can access almost anything on a system. This means they pose a high risk
    to any system that would allow all extensions to be installed by default.

severity: unknown

identifiers:
    cce: ""

references:
    disa: ""
    nist: ""
    stigid: DTBC0006

ocil_clause: 'extensions are not blacklisted'

ocil: |-
    To verify that all extensions are blacklisted from installing, run the following command:
    <pre>$ grep ExtensionInstallBlacklist /etc/chromium/policies/managed/*.json</pre>
    The output should contain:
    <pre>"ExtensionInstallBlacklist": ["*"],</pre>
