Mozilla Firefox Security Technical Implementation Guide

The Mozilla Firefox Security Technical Implementation Guide (V6 R9) has 33 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

33STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V6 · R9

CurrentPublished Wed Sep 30 2026

Firefox must not recommend extensions as the user is using the browser.

Mozilla Firefox Security Technical Implementation Guide

Assessment Title

Rule Text

Firefox must not recommend extensions as the user is using the browser.

Description

Discussion Text

The Recommended Extensions program recommends extensions to users as they surf the web.

The user must not be encouraged to install extensions from the websites they visit. Allowed extensions are to be centrally managed.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-251572

Rule

SV-251572r960963_rule

Severity

medium

Rule Version

FFOX-00-000028

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Type "about:policies" in the browser address bar. 

If "UserMessaging" is not displayed under Policy Name or the Policy Value is not "ExtensionRecommendations" with a value of "false", this is a finding.

Implementation Procedure

Fix Text

Windows group policy:
1. Open the group policy editor tool with "gpedit.msc".
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox\User Messaging
Policy Name: Extension Recommendations
Policy State: Disabled

macOS "plist" file:
Add the following:
<key>UserMessaging</key>
<dict>
  <key>ExtensionRecommendations</key>
  <false/>
</dict>

Linux "policies.json" file:
Add the following in the policies section:
"UserMessaging": {
  "ExtensionRecommendations": false
}

STIG check 26 of 33 in the Mozilla Firefox STIG checklist

← Previous · V-251571Firefox deprecated ciphers must be disabled.Next · V-251573 →The Firefox New Tab page must not show Top Sites, Sponsored Top Sites, Pocket Recommendations, Sponsored Pocket Stories, Searches, Highlights, or Snippets.