documentation_complete: true

title: 'Disable the 3D Graphics APIs'

description: |-
    Chromium uses WebGL to render graphics using the GPU which allows website
    access to the GPU. This should be disabled by setting <tt>Disable3DAPIs</tt>
    to <tt>true</tt> in the Chromium policy file.

rationale: |-
    This setting prevents web pages from accessing the graphics processing unit
    (GPU). Specifically, web pages cannot access the WebGL API and plugins cannot
    use the Pepper 3D API in order to reduce the attack surface.

severity: unknown

identifiers:
    cce: ""

references:
    disa: ""
    nist: ""
    stigid: DTBC0019

ocil_clause: 'it is not disabled'

ocil: |-
    To verify that 3D graphics are disabled, run the following command:
    <pre>$ grep Disable3DAPIs /etc/chromium/policies/managed/*.json</pre>
    The output should contain:
    <pre>"Disable3DAPIs": true,</pre>
