SV-251566r960963: Firefox network prediction must be disabled. | Mozilla Firefox for Linux STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

Firefox network prediction must be disabled.

Description

Discussion Text

If network prediction is enabled, requests to URLs are made without user consent. The browser should always make a direct DNS request without prefetching occurring.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000381

References

DPMS Target Mozilla Firefox 2021 VERSION DISA DPMS Target Mozilla Firefox 2021 VERSION 5446

Checks

DISA STIG (Manual Reference)

Type "about:policies" in the browser window. 

If "NetworkPrediction" is not displayed under Policy Name or the Policy Value is not "false", this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL definition: oval:mil.disa.stig.firefox.linux:def:121
filename="policies.json"
if [ ! -f "$filename" ]; then
    echo "PASS"
    exit 0
fi
content=$(cat "$filename")
if [[ $content =~ \{\s*"policies"\s*:\s*\{[\s\S]*?"NetworkPrediction"\s*:\s*(false|False|FALSE)[^}]*\} ]]; then
    echo "PASS"
    exit 0
else
    echo "FAIL"
    exit 1
fi

Remediation

Windows group policy:
1. Open the group policy editor tool with "gpedit.msc".
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox
Policy Name: Network Prediction
Policy State: Disabled

macOS "plist" file:
Add the following:
<key>NetworkPrediction</key>
<false/>

Linux "policies.json" file:
Add the following in the policies section:
"NetworkPrediction": false