Mozilla Firefox Security Technical Implementation Guide

The Mozilla Firefox Security Technical Implementation Guide (V6 R9) has 33 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

33STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V6 · R9

CurrentPublished Wed Sep 30 2026

Firefox must be configured to not automatically execute or download MIME types that are not authorized for auto-download.

Mozilla Firefox Security Technical Implementation Guide

Assessment Title

Rule Text

Firefox must be configured to not automatically execute or download MIME types that are not authorized for auto-download.

Description

Discussion Text

Some files can be downloaded or execute without user interaction. This setting ensures these files are not downloaded and executed.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-251550

Rule

SV-251550r961194_rule

Severity

medium

Rule Version

FFOX-00-000006

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Type "about:preferences" in the browser address bar. 

Type "Applications" in the Find bar in the upper-right corner. 

Determine if any of the following file extensions are listed: HTA, JSE, JS, MOCHA, SHS, VBE, VBS, SCT, WSC, FDF, XFDF, LSL, LSO, LSS, IQY, RQY, DOS, BAT, PS, EPS, WCH, WCM, WB1, WB3, WCH, WCM, AD.

If the entry exists and the "Action" is "Save File" or "Always Ask", this is not a finding.
 
If an extension exists and the entry in the Action column is associated with an application that does/can execute the code, this is a finding.

Implementation Procedure

Fix Text

Remove any unauthorized extensions from the auto-download list.

STIG check 6 of 33 in the Mozilla Firefox STIG checklist

← Previous · V-251549Firefox must be configured to not automatically update installed add-ons and plugins.Next · V-251551 →Firefox must be configured to disable form fill assistance.