Google Chrome Current Windows Security Technical Implementation Guide

The Google Chrome Current Windows Security Technical Implementation Guide (V2 R11) has 46 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

46STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R11

CurrentPublished Wed Jul 02 2025

URLs must be allowlisted for Autoplay use.

Google Chrome Current Windows Security Technical Implementation Guide

Assessment Title

Rule Text

URLs must be allowlisted for Autoplay use.

Description

Discussion Text

Controls the allowlist of URL patterns that autoplay will always be enabled on. If the "AutoplayAllowed" policy is set to "True" then this policy will have no effect. If the "AutoplayAllowed" policy is set to "False", then any URL patterns set in this policy will still be allowed to play.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-221596

Rule

SV-221596r961092_rule

Severity

medium

Rule Version

DTBC-0065

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Universal method:
1. In the omnibox (address bar), type chrome://policy.
2. If "AutoplayAllowlist" under the "Policy Name" column may be set to a list of administrator-approved URLs under the "Policy Value" column. This requirement is optional.

Windows method:
1. Start regedit.
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the "AutoplayAllowlist" key may contain a list of administrator-approved URLs. This requirement is optional.

Implementation Procedure

Fix Text

Windows group policy:
1. Open the "group policy editor" tool with gpedit.msc.
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome
- Policy Name: Allow media autoplay on a allowlist of URL patterns.
- Policy State: Enabled
- Policy Value 1: [*.]mil
- Policy Value 2: [*.]gov

Note: Policy values are examples.

STIG check 30 of 46 in the Google Chrome Current Windows STIG checklist

← Previous · V-221595Autoplay must be disabled.Next · V-221597 →Anonymized data collection must be disabled.