documentation_complete: true

title: 'Prevent Desktop Notifications'

description: |-
    Chromium by default allows websites to display notifications on the desktop.
    To disable this setting, set <tt>DefaultNotificationsSetting</tt> to <tt>2</tt>
    in the Chromium policy file.

rationale: "Disabling Chromium's ability to display notifications on the desktop helps prevent \nmalicious websites from controlling desktop notifications or fooling users into\nclicking on a potentially compromised notification."

severity: unknown

identifiers:
    cce: ""

references:
    disa: ""
    nist: ""
    stigid: DTBC0003

ocil_clause: 'it is not disabled'

ocil: |-
    To verify that desktop notification is
    disabled, run the following command:
    <pre>$ grep DefaultNotificationsSetting /etc/chromium/policies/managed/*.json</pre>
    The output should contain:
    <pre>"DefaultNotificationsSetting": 2,</pre>
