V6R9 changes
Mozilla Firefox for Windows SCAP Benchmark V6R9 (2026-08-19) replaced V6R8 (2026-05-08): 3 rules updated. It has 24 rules, against 24 in V6R8.
V6R9 benchmarkV6R8 benchmark Compare V6R8 and V6R9 in SCAP Compare
- 0 added
- 0 removed
- 3 updated
Updated fields: Check text 3Discussion 3
Updated in V6R9 (3)
V-251552CAT IIFirefox must be configured to not use a password store with or without a master password.Check text, Discussion
Check text
AND
- Software\Policies\Mozilla\Firefox\PasswordManagerEnabled is set to 0 reg_dword
registry_test (check: all, existence: at_least_one_exists)
object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "PasswordManagerEnabled"; key equals "SOFTWARE\\Policies\\Mozilla\\Firefox"
state registry_state: type equals "reg_dword"; value equals "0"
Type "about:policies" in the browser window.
If "PasswordManagerEnabled" is not displayed under Policy Name or the Policy Value is not "false", this is a finding.
Discussion
Firefox can be set to store passwords for sites visited by the user. These individual passwords are stored in a file and can be protected by a master password. Autofill of the password can then be enabled when the site is visited. This feature could also be used to autofill the certificate PIN, which could lead to compromise of DoDDoW information.
V-251577CAT IIFirefox must be configured so that DNS over HTTPS is disabled.Check text, Discussion
Check text
AND
- Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Enabled is set to 0 reg_dword
registry_test (check: all, existence: at_least_one_exists)
object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "Enabled"; key equals "SOFTWARE\\Policies\\Mozilla\\Firefox\\DNSOverHTTPS"
state registry_state: type equals "reg_dword"; value equals "0"
Type "about:policies" in the browser address bar.
If "DNSOverHTTPS" is not displayed under Policy Name or the Policy Value does not have "Enabled" with a value of "false", this is a finding.
Discussion
DNS over HTTPS has generally not been adopted in the DoDDoW. DNS is tightly controlled.
It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.
Applications are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).
Examples of non-essentialnonessential capabilities include, but are not limited to, advertising software or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, but cannot be disabled.
V-252909CAT IIFirefox Studies must be disabled.Check text, Discussion
Check text
AND
- Software\Policies\Mozilla\Firefox\DisableFirefoxStudies is set to 1 reg_dword
registry_test (check: all, existence: at_least_one_exists)
object registry_object: hive equals "HKEY_LOCAL_MACHINE"; name equals "DisableFirefoxStudies"; key equals "SOFTWARE\\Policies\\Mozilla\\Firefox"
state registry_state: type equals "reg_dword"; value equals "1"
Type "about:policies" in the browser address bar.
If "DisableFirefoxStudies" is not displayed under Policy Name or the Policy Value does not have a value of "true", this is a finding.
Discussion
Studies try out different features and ideas before they are released to all Firefox users. Testing beta software is not in the DoDW user's mission.
How these changes are found
Rules are matched across the two benchmark releases by their STIG V-number. A rule counts as updated when its rule id changed and its title, severity, discussion, fix text or OVAL check logic changed — the same comparison SCAP Compare makes.
Comparing other releases, or this one against an older release? Pick any two in SCAP Compare.