documentation_complete: true

title: 'Disable Chromium Password Manager'

description: "Chromium Password Manager allows the saving and using of passwords in Chromium. This\nshould be disabled by setting <tt>PasswordManagerEnabled</tt> to <tt>false</tt> in \nthe Chromium policy file."

rationale: |-
    Enables saving passwords and using saved passwords in Google Chromium. Malicious
    sites may take advantage of this feature by using hidden fields gain access
    to the stored information.

severity: unknown

identifiers:
    cce: ""

references:
    disa: ""
    nist: ""
    stigid: DTBC0011

ocil_clause: 'it is not disabled'

ocil: |-
    To verify that the use of Password Manager is disabled, run the following command:
    <pre>$ grep PasswordManagerEnabled /etc/chromium/policies/managed/*.json</pre>
    The output should contain:
    <pre>"PasswordManagerEnabled": false,</pre>
