Every Chrome policy and what it does when you leave it alone

If SafeBrowsingEnabled is not Disabled, then setting AbusiveExperienceInterventionEnforce to Enabled or leaving it unset prevents sites with abusive experiences from opening new windows or tabs. Setting SafeBrowsingEnabled to Disabled or AbusiveExperienceInterventionEnforce to Disabled lets sites with abusive experiences open new windows or tabs.

Unless SafeBrowsingEnabled is set to False, then setting AdsSettingForIntrusiveAdsSites to 1 or leaving it unset allows ads on all sites. Setting the policy to 2 blocks ads on sites with intrusive ads.

Setting the policy provides access to the listed URLs, as exceptions to URLBlocklist. See that policy's description for the format of entries of this list. For example, setting URLBlocklist to * will block all requests, and you can use this policy to allow access to a limited list of URLs. Use it to open exceptions to certain schemes, subdomains of other domains, ports, or specific paths, using the format specified at ( https://support.google.com/chrome/a?p=url_blocklist_filter_format ). The most specific filter determines if a URL is blocked or allowed. The URLAllowlist policy takes precedence over URLBlocklist. This policy is limited to 1,000 entries. This policy also allows enabling the automatic invocation by the browser of external application registered as protocol handlers for the listed protocols like "tel:" or "ssh:". Leaving the policy unset allows no exceptions to URLBlocklist. From Google Chrome version 92, this policy is also supported in the headless mode. Example value: example.com https://ssl.server.com hosting.com/good_path https://server:8080/path .exact.hostname.com

Setting the policy provides access to the listed URLs in Incognito mode. Use it to open exceptions to certain URL patterns defined in IncognitoModeUrlBlocklist, using the format specified at ( https://support.google.com/chrome/a?p=url_blocklist_filter_format ). If both this policy and IncognitoModeUrlBlocklist are set, the allowlist takes precedence. If a URL matches a pattern on the allowlist, it will be allowed. If it matches a pattern on the blocklist (but not the allowlist), it will be blocked. If a URL matches neither, the general URLBlocklist/URLAllowlist policies will be used as a fallback. If this policy is set and IncognitoModeUrlBlocklist is not, any URL not on the allowlist will be blocked in Incognito mode. If IncognitoModeAvailability is set to disallow (value 1), but this policy is configured, Incognito mode will be available only for the URLs matching the allowlist. Leaving the policy unset allows no exceptions to IncognitoModeUrlBlocklist and IncognitoModeAvailability. This policy only affects Incognito mode. To allow URLs for all user profiles, please use the URLAllowlist policy. This policy is limited to 1000 entries. Example value: example.com https://ssl.server.com hosting.com/bad_path https://server:8080/path .exact.hostname.com file://* custom_scheme:* *

Controls whether users may use Chrome for Testing. If this policy is set to Enabled or not set, users may install and run Chrome for Testing. If this policy is set to Disabled, users are not allowed to run Chrome for Testing. Users will still be able to install Chrome for Testing, however it will not run with the profiles where this policy is set to Disabled.

Setting the policy to Enabled means Google Chrome can collect WebRTC event logs from Google services such as Hangouts Meet and upload them to Google. These logs have diagnostic information for debugging issues with audio or video meetings in Google Chrome, such as the time and size of RTP packets, feedback about congestion on the network, and metadata about time and quality of audio and video frames. These logs have no audio or video content from the meeting. To make debugging easier, Google might associate these logs, by means of a session ID, with other logs collected by the Google service itself. Setting the policy to Disabled results in no collection or uploading of such logs. Leaving the policy unset on versions up to and including M76 means Google Chrome defaults to not being able to collect and upload these logs. Starting at M77, Google Chrome defaults to being able to collect and upload these logs from most profiles affected by cloud-based, user-level enterprise policies. From M77 up to and including M80, Google Chrome can also collect and upload these logs by default from profiles affected by Google Chrome on-premise management.

Enables the use of a default search provider on the context menu. If you set this policy to disabled the search context menu item that relies on your default search provider will not be available. If this policy is set to enabled or not set, the context menu item for your default search provider will be available. The policy value is only appled when the DefaultSearchProviderEnabled policy is enabled, and is not applicable otherwise.

Setting the policy to True allows users to play the dinosaur game. Setting the policy to False means users can't play the dinosaur easter egg game when device is offline. Leaving the policy unset means users can't play the game on enrolled Google ChromeOS, but can under other circumstances.

This policy controls whether Google Chrome may query additional DNS record types when making insecure DNS requests. This policy has no effect on DNS queries made via Secure DNS, which may always query additional DNS types. If this policy is unset or set to Enabled, additional types such as HTTPS (DNS type 65) may be queried in addition to A (DNS type 1) and AAAA (DNS type 28). If this policy is set to Disabled, DNS will only be queried for A (DNS type 1) and/or AAAA (DNS type 28). This policy is a temporary measure and will be removed in future versions of Google Chrome. After removal of the policy, Google Chrome will always be able to query additional DNS types.

For security reasons, the showOpenFilePicker(), showSaveFilePicker() and showDirectoryPicker() web APIs require a prior user gesture ("transient activation") to be called or will otherwise fail. With this policy set, admins can specify origins on which these APIs can be called without prior user gesture. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns/. * is not an accepted value for this policy. If this policy is unset, all origins will require a prior user gesture to call these APIs. Example value: https://www.example.com [*.]example.edu

Setting the policy to True or leaving it unset means that, with appropriate permissions, users, apps, and extensions can enter Fullscreen mode (in which only web content appears). Setting the policy to False means users, apps, and extensions can't enter Fullscreen mode.

This policy controls whether users can enable HTTPS-Only Mode (Always Use Secure Connections) in Settings. HTTPS-Only Mode upgrades all navigations to HTTPS. If this setting is not set or set to "allowed", users will be allowed to enable HTTPS-Only Mode. If this setting is set to "disallowed", HTTPS-Only Mode will be disabled. If this setting is set to "force_enabled", HTTPS-Only Mode will be enabled in Strict mode. If this setting is set to "force_balanced_enabled", HTTPS-Only Mode will be enabled in Balanced mode. "force_enabled" is supported from M112 onwards, "force_balanced_enabled" is supported from M129 onwards. "force_enabled" and "force_balanced_enabled" can be recommended to users too. HTTPS-Only Mode will be set Strict or Balanced initially but users are allowed to change it. If you set this policy to a value that is not supported by the version of Chrome that receives the policy, Chrome will default to the allowed setting. The separate HttpAllowlist policy can be used to exempt specific hostnames or hostname patterns from being upgraded to HTTPS by this feature. Example value: disallowed

Setting the policy to Enabled or leaving it unset means Chrome can display, and users can open, file selection dialogs. Setting the policy to Disabled means that whenever users perform actions provoking a file selection dialog, such as importing bookmarks, uploading files, and saving links, a message appears instead. The user is assumed to have clicked Cancel on the file selection dialog.

Setting the policy to True lets Google Chrome autoplay media. Setting the policy to False stops Google Chrome from autoplaying media. If this policy is left unset, Google Chrome doesn't autoplay media. But, for certain URL patterns, you can use the AutoplayAllowlist policy to change this setting. If this policy changes while Google Chrome is running, it only applies to newly opened tabs.

Setting the policy to Enabled or leaving it unset means that, with the exception of URLs set in the AudioCaptureAllowedUrls list, users get prompted for audio capture access. Setting the policy to Disabled turns off prompts, and audio capture is only available to URLs set in the AudioCaptureAllowedUrls list. Note: The policy affects all audio input (not just the built-in microphone).

Setting the policy to Enabled or leaving it unset means that, with the exception of URLs set in the VideoCaptureAllowedUrls list, users get prompted for video capture access. Setting the policy to Disabled turns off prompts, and video capture is only available to URLs set in the VideoCaptureAllowedUrls list. Note: The policy affects all video input (not just the built-in camera).

This policy controls if a page can use the built-in AI APIs (such as LanguageModel API, Summarization API, Writer API, and Rewriter API). If the policy is enabled or unset, the APIs are enabled to be used. If the policy is disabled, attempting using the APIs will result in an error.

This policy controls if a page with Cache-Control: no-store header can be stored in back/forward cache. The website setting this header may not expect the page to be restored from back/forward cache since some sensitive information could still be displayed after the restoration even if it is no longer accessible. If the policy is enabled or unset, the page with Cache-Control: no-store header might be restored from back/forward cache unless the cache eviction is triggered (e.g. when there is HTTP-only cookie change to the site). If the policy is disabled, the page with Cache-Control: no-store header will not be stored in back/forward cache.

Setting the policy to Enabled or leaving it unset lets users click through warning pages Google Chrome shows when users navigate to sites that have SSL errors. Setting the policy to Disabled prevent users from clicking through any warning pages.

If SSLErrorOverrideAllowed is Disabled, setting the policy lets you set a list of origin patterns that specify the sites where a user can click through warning pages Google Chrome shows when users navigate to sites that have SSL errors. Users will not be able to click through SSL warning pages on origins that are not on this list. If SSLErrorOverrideAllowed is Enabled or unset, this policy does nothing. Leaving the policy unset means SSLErrorOverrideAllowed applies for all sites. For detailed information on valid input patterns, please see https://chromeenterprise.google/policies/url-patterns/. * is not an accepted value for this policy. This policy only matches based on origin, so any path in the URL pattern is ignored. Example value: https://www.example.com [*.]example.edu

Setting the policy to Enabled or leaving it unset means Google Chrome send occasional queries to a Google server to retrieve an accurate timestamp. Setting the policy to Disabled stops Google Chrome from sending these queries.

Setting the policy to Enabled or leaving it unset allows the use of QUIC protocol in Google Chrome. Setting the policy to Disabled disallows the use of QUIC protocol.

Controls whether users may use remote debugging. If this policy is set to Enabled or not set, users may use remote debugging by specifying --remote-debugging-port and --remote-debugging-pipe command line switches. If this policy is set to Disabled, users are not allowed to use remote debugging.

If this policy is set false, domain reliability diagnostic data reporting is disabled and no data is sent to Google. If this policy is set true or not set, domain reliability diagnostic data reporting will follow the behavior of MetricsReportingEnabled for Google Chrome or DeviceMetricsReportingEnabled for Google ChromeOS.

For security reasons, the getDisplayMedia() web API requires a prior user gesture ("transient activation") to be called or will otherwise fail. With this policy set, admins can specify origins on which this API can be called without prior user gesture. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns/. * is not an accepted value for this policy. If this policy is unset, all origins will require a prior user gesture to call this API. Example value: https://www.example.com [*.]example.edu

https://github.com/w3c/ServiceWorker/issues/765 asks srcdoc iframe with the "allow-same-origin" sandbox attribute to be under ServiceWorker control. Setting the policy to Enabled or leaving it unset means Google Chrome makes srcdoc iframes with "allow-same-origin" sandbox attributes to be under ServiceWorker control. Setting the policy to Disabled leaves the srcdoc iframe not controlled by ServiceWorker. This policy is intended to be temporary and will be removed in 2026.

https://github.com/WICG/service-worker-auto-preload The ServiceWorkerAutoPreload feature dispatches a network request for a main resource at the same time it begins the ServiceWorker bootstrap process. Setting the policy to Enabled or leaving it unset means Google Chrome enables ServiceWorkerAutoPreload. The navigation request is automatically dispatched while starting the ServiceWorker in some scenarios, e.g. ServiceWorker is not running, If it is disabled, Google Chrome will not enable ServiceWorkerAutoPreload. The navigation request is dispatched always after starting the ServiceWorker. This policy is a temporary measure to control the feature and will be removed in M154.

Setting the policy to Enabled or leaving the policy unset means that users can bring up their most recent default search engine results page in a side panel via toggling an icon in the toolbar. Setting the policy to Disabled removes the icon from the toolbar that opens the side panel with the default search engine results page.

Socket pool size randomization is a security mechanism that prevents attackers from exploiting deterministic capacity limits to learn cross-site information. If the capacity for a pool is normally 128 sockets, this mechanism randomly caps the pool between 128 and 256. This can allow up to 2x as many connections to the proxy, but in practice the expected value is more like 1.2x. This impacts the settings from MaxConnectionsPerProxy and MaxConnectionsPerProxyForWebSocket. Instead of them defining the upper limit, the upper limit is 2x their values (though again, the expected value in practice is more like 1.2x them). This is enabled by default for all pools, but this policy allows the feature to be disabled for proxy pools specifically.

A policy that controls if SwiftShader will be used as a WebGL fallback when hardware GPU acceleration is not available. SwiftShader has been used to support WebGL on systems without GPU acceleration such as headless systems or virtual machines but has been deprecated due to security issues. Starting in M139, WebGL context creation will fail when it would have otherwise used SwiftShader. This policy allows the browser or administrator to temporarily defer the deprecation. Setting the policy to Enabled, SwiftShader will be used as a software WebGL fallback. Setting the policy to Disabled or not set, WebGL context creation may fail if hardware GPU acceleration is not available. Web pages may misbehave if they do not gracefully handle WebGL context creation failure. This is a temporary policy which will be removed in the future.

SpeculationRules prefetch can be issued to URLs that are controlled by ServiceWorker. However, legacy code did not allow it and canceled the prefetch requests. This policy enables to control the behavior. Setting this policy to Enabled or not set allows SpeculationRules prefetch to ServiceWorker-controlled URLs (if the PrefetchServiceWorker feature flag is enabled). This is the current default behavior and is aligned with the specifications. Setting this policy to Disabled disallows SpeculationRules prefetch to ServiceWorker-controlled URLs. This is the legacy behavior. This policy is intended to be temporary and will be removed in the future.

This policy controls the priority of the audio process on Windows. If this policy is enabled, the audio process will run with above normal priority. If this policy is disabled, the audio process will run with normal priority. If this policy is not set, the default configuration for the audio process will be used. This policy is intended as a temporary measure to give enterprises the ability to run audio with higher priority to address certain performance issues with audio capture. This policy will be removed in the future.

This policy controls the audio process sandbox. If this policy is enabled, the audio process will run sandboxed. If this policy is disabled, the audio process will run unsandboxed and the WebRTC audio-processing module will run in the renderer process. This leaves users open to security risks related to running the audio subsystem unsandboxed. If this policy is not set, the default configuration for the audio sandbox will be used, which may differ per platform. This policy is intended to give enterprises flexibility to disable the audio sandbox if they use security software setups that interfere with the sandbox.

This policy controls the availability of the shopping list feature. If enabled, users will be presented with UI to track the price of the product displayed on the current page. The tracked product will be shown in the bookmarks side panel. If this policy is set to Enabled or not set, the shopping list feature will be available to users. If this policy is set to Disabled, the shopping list feature will be unavailable.

Setting the policy to Enabled or leaving it unset allows the use of Translator API in Google Chrome. Setting the policy to Disabled disallows the use of Translator API.

Setting the policy to Enabled allows policies associated with a managed account to take precedence if they conflict with Chrome Enterprise Core browser policies. Setting the policy to Disabled or leaving it unset causes user-level cloud policies to have default priority. Only policies originating from secure users can take precedence. A secure user is affiliated with the organization that manages their browser using Chrome Enterprise Core. All other user-level policies will have default precedence. The policy can be combined with CloudPolicyOverridesPlatformPolicy. If both policies are enabled, user cloud policies will also take precedence over conflicting platform policies.

Setting the policy to Enabled or leaving it unset lets users send feedback to Google through Menu > Help > Report an Issue or key combination. Setting the policy to Disabled means users can't send feedback to Google.

If the policy is set to false, the New Tab page won't allow users to customize the background. Any existing custom background will be permanently removed even if the policy is set to true later. If the policy is set to true or unset, users can customize the background on the New Tab page.

If set to Enabled, Google Chrome will allow Web Authentication requests on websites that have TLS certificates with errors (i.e. websites considered not secure). If the policy is set to Disabled or left unset, the default behavior of blocking such requests will apply.

Setting the policy to enabled means Google Chrome can collect WebRTC text logs from Google services such as Google Meet and upload them to Google. These logs have diagnostic information for debugging issues with audio or video meetings in Google Chrome, such as textual metadata describing incoming and outgoing WebRTC streams, WebRTC specific log entries and additional system information. These logs have no audio or video content from the meeting. Setting the policy to disabled results in no uploading of such logs to Google. Logs would still accumulate locally on the user's device. Leaving the policy unset means Google Chrome defaults to being able to collect and upload these logs.

Allows you to set whether websites are allowed to check if the user has payment methods saved. If this policy is set to disabled, websites that use PaymentRequest.canMakePayment or PaymentRequest.hasEnrolledInstrument API will be informed that no payment methods are available. If the setting is enabled or not set then websites are allowed to check if the user has payment methods saved.

This policy allows origin-keyed agent clustering by default. The Origin-Agent-Cluster HTTP header controls whether a document is isolated in an origin-keyed agent cluster, or in a site-keyed agent cluster. This has security implications since an origin-keyed agent cluster allows isolating documents by origin. The developer-visible consequence of this is that the document.domain accessor can no longer be set. The default behaviour - when no Origin-Agent-Cluster header has been set - changes in M111 from site-keyed to origin-keyed. If this policy is enabled or not set, the browser will follow this new default from that version on. If this policy is disabled this change is reversed and documents without Origin-Agent-Cluster headers will be assigned to site-keyed agent clusters. As a consequence, the document.domain accessor remains settable by default. This matches the legacy behaviour. See https://developer.chrome.com/blog/immutable-document-domain/ for additional details.

Setting the policy to Enabled turns the internal PDF viewer off in Google Chrome, treats PDF files as a download, and lets users open PDFs with the default application. Setting the policy to Disabled means that unless users turns off the PDF plugin, it will open PDF files. If you set the policy, users can't change it in Google Chrome. If not set, users can choose whether to open PDF externally or not.

Setting the policy specifies the locale Google Chrome uses. Turning it off or leaving it unset means the locale will be the first valid locale from: 1) The user specified locale (if configured). 2) The system locale. 3) The fallback locale (en-US). Example value: en

Setting the policy to Enabled means users are asked where to save each file before downloading. Setting the policy to Disabled has downloads start immediately, and users aren't asked where to save the file. Leaving the policy unset lets users change this setting.

Setting the URLBlocklist policy stops web pages with prohibited URLs from loading. Administrators can specify the list of URL patterns to be blocked. If left unset, no URLs are blocked in the browser. Up to 1,000 exceptions can be defined in URLAllowlist. See how to format a URL pattern ( https://support.google.com/chrome/a?p=url_blocklist_filter_format ). Note: This policy does not apply to in-page JavaScript URLs with dynamically loaded data. If you blocked example.com/abc, then example.com could still load it using XMLHTTPRequest. Additionally, this policy does not prevent web pages from updating the URL shown in the omnibox to a blocked one using the JavaScript History API. From Google Chrome version 73, you can block javascript://* URLs. But, this only affects JavaScript entered in the address bar or, for example, bookmarklets. From Google Chrome version 92, this policy is also supported in the headless mode. From Google Chrome version 147, the wildcard * on its own does not apply to internal chrome:// URLs. To block these, you must explicitly use the chrome://* pattern. Note: Blocking internal chrome://* and chrome-untrusted://* URLs can lead to unexpected errors or can be circumvented in some cases. Instead of blocking certain internal URLs, see if there are more specific policies available. For example: - Instead of blocking chrome://settings/certificates, use CACertificateManagementAllowed. - Instead of blocking chrome-untrusted://crosh, use SystemFeaturesDisableList. - Instead of blocking devtools://*, use one of the DeveloperToolsAvailability, DeveloperToolsAvailabilityAllowlist or DeveloperToolsAvailabilityBlocklist policies. Example value: example.com https://ssl.server.com hosting.com/bad_path https://server:8080/path .exact.hostname.com file://* custom_scheme:* *

Setting the policy to Enabled or leaving it unset will permit Google Chrome to apply the additional extension point security mitigation to block legacy extension points in the Browser process. Setting the policy to Disabled has a detrimental effect on Google Chrome's security and stability as unknown and potentially hostile code can load inside Google Chrome's browser process. Only turn off the policy if there are compatibility issues with third-party software that must run inside Google Chrome's browser process. Note: Read more about Process mitigation policies ( https://chromium.googlesource.com/chromium/src/+/HEAD/docs/design/sandbox.md#Process-mitigation-policies ).

Setting the policy to Enabled prevents webpage elements that aren't from the domain that's in the browser's address bar from setting cookies. Setting the policy to Disabled lets those elements set cookies and prevents users from changing this setting. Leaving it unset allows third-party cookies, but users can change this setting. Note: This policy doesn't apply in Incognito mode, where third-party cookies are blocked and can only be allowed at the site level. To allow cookies at the site level, use the CookiesAllowedForUrls policy.

Setting the policy to Enabled or leaving the policy unset means that users can access browser experimental features through an icon in the toolbar Setting the policy to Disabled removes the browser experimental features icon from the toolbar. chrome://flags and any other means of turning off and on browser features will still behave as expected regardless of whether this policy is Enabled or Disabled.

This policy controls the sign-in behavior of the browser. It allows you to specify if the user can sign in to Google Chrome with their account and use account related services like Google Chrome Sync. If the policy is set to "Disable browser sign-in" then the user cannot sign in to the browser and use account-based services. In this case browser-level features like Google Chrome Sync cannot be used and will be unavailable. On iOS, if the user was signed in and the policy is set to "Disabled" they will be signed out immediately. On other platforms, they will be signed out the next time they run Google Chrome. On all platforms, their local profile data like bookmarks, passwords etc. will be preserved and still usable. The user will still be able to sign into and use Google web services like Gmail. If the policy is set to "Enable browser sign-in," then the user is allowed to sign in to the browser. On all platforms except iOS, the user is automatically signed in to the browser when signed in to Google web services like Gmail. Being signed in to the browser means the user's account information will be kept by the browser. However, it does not mean that Google Chrome Sync will be turned on by default; the user must separately opt-in to use this feature. Enabling this policy will prevent the user from turning off the setting that allows browser sign-in. To control the availability of Google Chrome Sync, use the SyncDisabled policy. If the policy is set to "Force browser sign-in" the user is presented with an account selection dialog and has to choose and sign in to an account to use the browser. This ensures that for managed accounts the policies associated with the account are applied and enforced. The default value of BrowserGuestModeEnabled will be set to disabled. Note that existing unsigned profiles will be locked and inaccessible after enabling this policy. For more information, see help center article: https://support.google.com/chrome/?p=force_browser_signin . This option is not supported on Google ChromeOS nor Android, where it will fall back to "Enable browser sign-in" if used. If this policy is not set then the user can decide if they want to enable browser sign-in in the Google Chrome settings and use it as they see fit.

This policy changes the savings level of Memory Saver. This only takes effect when Memory Saver is enabled through settings or through the HighEfficiencyModeEnabled policy, and will affect how heuristics are used to determine when to discard tabs. For example, reducing the lifetime of an inactive tab before discarding it can save memory, but it also means that tabs will be reloaded more frequently which can lead to bad user experience and cost more network traffic. Setting the policy to 0 - Memory Saver will get moderate memory savings. Tabs become inactive after a longer period of time Setting the policy to 1 - Memory Saver will get balanced memory savings. Tabs become inactive after an optimal period of time. Setting the policy to 2 - Memory Saver will get maximum memory savings. Tabs become inactive after a shorter period of time. If this policy is unset, the end user can control this setting in chrome://settings/performance.

Setting the policy specifies a list of web apps that install silently, without user interaction, and which users can't uninstall or turn off. Each list item of the policy is an object with a mandatory member: url (the URL of the web app to install) and 6 optional members: - default_launch_container (for how the web app opens—a new tab is the default) - create_desktop_shortcut (True if you want to create Linux and Microsoft® Windows® desktop shortcuts). - fallback_app_name (Starting with Google Chrome version 90, allows you to override the app name if it is not a Progressive Web App (PWA), or the app name that is temporarily installed if it is a PWA but authentication is required before the installation can be completed. If both custom_name and fallback_app_name are provided, the latter will be ignored.) - custom_name (Starting with Google ChromeOS version 99, and version 112 on all other desktop operating systems, allows you to permanently override the app name for all web apps and PWAs.) - custom_icon (Starting with Google ChromeOS version 99, and version 112 on all other desktop operating systems, allows you to override the app icon of installed apps. The icons have to be square, maximal 1 MB in size, and in one of the following formats: jpeg, png, gif, webp, ico. The hash value has to be the SHA256 hash of the icon file. The url should be accessible without authentication to ensure the icon can be used upon app installation.) - install_as_shortcut (Starting with Google Chrome version 107). If enabled the given url will be installed as a shortcut, as if done via the "Create Shortcut..." option in the desktop browser GUI. Note that when installed as a shortcut it won't be updated if the manifest in url changes. If disabled or unset, the web app at the given url will be installed normally. See PinnedLauncherApps for pinning apps to the Google ChromeOS shelf. See https://chromeenterprise.google/policies/?policy=WebAppInstallForceList for more information about schema and formatting. Example value: [ { "create_desktop_shortcut": true, "default_launch_container": "window", "url": "https://www.google.com/maps" }, { "default_launch_container": "tab", "url": "https://docs.google.com" }, { "default_launch_container": "window", "fallback_app_name": "Editor", "url": "https://docs.google.com/editor" }, { "custom_name": "My important document", "default_launch_container": "window", "install_as_shortcut": true, "url": "https://docs.google.com/document/d/ds187akjqih89" }, { "custom_icon": { "hash": "c28f469c450e9ab2b86ea47038d2b324c6ad3b1e9a4bd8960da13214afd0ca38", "url": "https://mydomain.example.com/sunny_icon.png" }, "url": "https://weather.example.com" } ]

This policy allows admins to configure the color of Google Chrome's theme. The input string should be a valid hex color string matching the format "#RRGGBB". Setting the policy to a valid hex color causes a theme based on that color to be automatically generated and applied to the browser. Users won't be able to change the theme set by the policy. Leaving the policy unset lets users change their browser's theme as preferred. Example value: #FFFFFF

This policy allows admins to configure the order of the preferred languages in Google Chrome's settings. The order of the list will appear in the same order under the "Order languages based on your preference" section in chrome://settings/languages. Users won't be able to remove or reorder languages set by the policy, but will be able to add languages underneath those set by the policy. Users will also have full control over the browser's UI language and translation/spell check settings, unless enforced by other policies. Leaving the policy unset lets users manipulate the entire list of preferred languages. Example value: en-US

Setting the policy to Enabled turns background mode on. In background mode, a Google Chrome process is started on OS sign-in and keeps running when the last browser window is closed, allowing background apps and the browsing session to remain active. The background process displays an icon in the system tray and can always be closed from there. Setting the policy to Disabled turns background mode off. If you set the policy, users can't change it in the browser settings. If unset, background mode is off at first, but users can change it.

The Accept-Language HTTP request header and the JavaScript navigator.languages getter are planned for reduction for privacy reasons. To facilitate testing and ensure compatibility, this policy allows you to enable or disable the Accept-Language Reduction feature. If this policy is set to enabled or left unset, Accept-Language Reduction will be applied through field trials. If this policy is set to disabled, field trials will not be able to activate Accept-Language Reduction. For more information about this feature, please visit: https://github.com/explainers-by-googlers/reduce-accept-language. NOTE: Only newly-started renderer processes will reflect changes to this policy while the browser is running.

Setting the policy controls the SafeSites URL filter, which uses the Google Safe Search API to classify URLs as pornographic or not. When this policy is set to: * Do not filter sites for adult content, or not set, sites aren't filtered * Filter sites for adult content, pornographic sites are filtered The policy applies to both the URL the user navigates to and to iframes. The URLAllowlist policy takes precedence over this policy and can be used to override verdicts from the Google Safe Search API.

This policy controls the availability of the XSLT feature (the XSLTProcessor Javascript API and the XSL processing instruction). If this policy is set to Enabled, XSLT will be available, regardless of the default state of the feature in the browser. If this policy is set to Disabled, XSLT will be unavailable, regardless of the default state of the feature in the browser. If this policy is left unset, XSLT availability will be determined by the browser's default settings and field trials. This policy is a temporary measure, and will be removed in M164.

When enabled the IntensiveWakeUpThrottling feature causes JavaScript timers in background tabs to be aggressively throttled and coalesced, running no more than once per minute after a page has been backgrounded for 5 minutes or more. This is a web standards compliant feature, but it may break functionality on some websites by causing certain actions to be delayed by up to a minute. However, it results in significant CPU and battery savings when enabled. See https://bit.ly/30b1XR4 for more details. If this policy is set to enabled then the feature will be force enabled, and users will not be able to override this. If this policy is set to disabled then the feature will be force disabled, and users will not be able to override this. If this policy is left unset then the feature will be controlled by its own internal logic, which can be manually configured by users. Note that the policy is applied per renderer process, with the most recent value of the policy setting in force when a renderer process starts. A full restart is required to ensure that all loaded tabs receive a consistent policy setting. It is harmless for processes to be running with different values of this policy.

This policy determines whether an attribution to the extension modifying the New Tab Page (NTP) is displayed in the NTP's footer. By default, if an extension has overridden the standard NTP, a message attributing this change to the specific extension will appear in the footer. This attribution typically includes a link to the relevant extension in the Chrome Web Store. If this policy is left unset or set to true, the extension attribution will be visible on the NTP footer when an extension is controlling the NTP. If this policy is set to false, the attribution to the extension in the NTP footer will be suppressed.

This policy controls the visibility of the management notice within the footer of the New Tab Page (NTP). By default, the NTP footer displays information when the browser is managed by an organization (indicated by a building icon and "Managed by [domain name]"). This can be customized using the EnterpriseCustomLabelForBrowser and EnterpriseLogoUrlForBrowser policies. If this policy is left unset or set to true, managed browsers will display a “Managed by…” notice with an icon. If this policy is set to false, the management notice will be hidden. Note that this policy is only applied for managed browsers, so it will have no effect for managed users on unmanaged browsers. On Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core. On macOS, this policy is only available on instances that are managed via MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.

Setting this policy to Enabled or leaving the policy unset allows use of the headless mode. Setting this policy to Disabled denies use of the headless mode.

When enabled, the storage quota APIs will return a static value equal to usage + min(10 GiB, disk rounded up to the nearest 1 GiB). When disabled, the storage quota APIs will generally return a dynamic value proportional to the total space available on the device, regardless of usage. If unset, the storage quota APIs will use the default Chrome behavior. Sites with unlimited storage permissions are unaffected by this setting. Enforced quota is also unaffected.

Controls the mode of the DNS-over-HTTPS resolver. Please note that this policy will only set the default mode for each query. The mode may be overridden for special types of queries such as requests to resolve a DNS-over-HTTPS server hostname. The "off" mode will disable DNS-over-HTTPS. The "automatic" mode will send DNS-over-HTTPS queries first if a DNS-over-HTTPS server is available and may fallback to sending insecure queries on error. The "secure" mode will only send DNS-over-HTTPS queries and will fail to resolve on error. On Android Pie and above, if DNS-over-TLS is active, Google Chrome will not send insecure DNS requests. If this policy is unset, for managed devices DNS-over-HTTPS queries will not be sent. Otherwise, the browser may send DNS-over-HTTPS requests to a resolver associated with the user's configured system resolver. Example value: off

For work and school profiles, the toolbar will show a "Work" or "School" label by default next to the toolbar avatar. The label will only be shown if the signed in account is managed. Setting this policy to hide_expanded_enterprise_toolbar_badge (value 1) will hide the enterprise badge for a managed profile in the toolbar. Leaving this policy unset or setting it to show_expanded_enterprise_toolbar_badge (value 0) will show the enterprise badge. The label is customizable via the EnterpriseCustomLabel policy.

unload event handlers are being deprecated. Whether they fire depends on the unload Permissions-Policy. Currently, they are allowed by policy by default. In the future they will gradually move to being disallowed by default and sites must explicitly enable them using Permissions-Policy headers. This enterprise policy can be used to opt out of this gradual deprecation by forcing the default to remain as enabled. Pages may depend on unload event handlers to save data or signal the end of a user session to the server. This is not recommended as it is unreliable and impacts performance by blocking use of BackForwardCache. Recommended alternatives exist, however the unload event has been used for a long time. Some applications may still rely on them. If this policy is set to false or not set, then unload events handlers will be gradually deprecated in-line with the deprecation rollout and sites which do not set Permissions-Policy header will stop firing `unload` events. If this policy is set to true then unload event handlers will continue to work by default. NOTE: This policy had an incorrectly documented default of `true` in M117. The unload event did and will not change in M117, so this policy has no effect in that version.

Configures support of CORS non-wildcard request headers. Google Chrome version 97 introduces support for CORS non-wildcard request headers. When scripts make a cross-origin network request via fetch() and XMLHttpRequest with a script-added Authorization header, the header must be explicitly allowed by the Access-Control-Allow-Headers header in the CORS preflight response. "Explicitly" here means that the wild card symbol "*" doesn't cover the Authorization header. See https://chromestatus.com/feature/5742041264816128 for more detail. If this policy is not set, or set to True, Google Chrome will support the CORS non-wildcard request headers and behave as described above. When this policy is set to False, chrome will allow the wildcard symbol ("*") in the Access-Control-Allow-Headers header in the CORS preflight response to cover the Authorization header. This Enterprise policy is temporary; it's intended to be removed in the future.

Allows you to set a list of protocols, and for each protocol an associated list of allowed origin patterns, that can launch an external application without prompting the user. The trailing separator should not be included when listing the protocol, so list "skype" instead of "skype:" or "skype://". If this policy is set, a protocol will only be permitted to launch an external application without prompting by policy if the protocol is listed, and the origin of the site trying to launch the protocol matches one of the origin patterns in that protocol's allowed_origins list. If either condition is false the external protocol launch prompt will not be omitted by policy. If this policy is not set, no protocols can launch without a prompt by default. Users may opt out of prompts on a per-protocol/per-site basis unless the ExternalProtocolDialogShowAlwaysOpenCheckbox policy is set to Disabled. This policy has no impact on per-protocol/per-site prompt exemptions set by users. The origin matching patterns use a similar format to those for the 'URLBlocklist' policy, which are documented at https://support.google.com/chrome/a?p=url_blocklist_filter_format. However, origin matching patterns for this policy cannot contain "/path" or "@query" elements. Any pattern that does contain a "/path" or "@query" element will be ignored. See https://chromeenterprise.google/policies/?policy=AutoLaunchProtocolsFromOrigins for more information about schema and formatting. Example value: [ { "allowed_origins": [ "example.com", "http://www.example.com:8080" ], "protocol": "spotify" }, { "allowed_origins": [ "https://example.com", "https://.mail.example.com" ], "protocol": "teams" }, { "allowed_origins": [ "*" ], "protocol": "outlook" } ]

Setting the policy turns on Chrome's restricted sign-in feature in Google Workspace and prevents users from changing this setting. Users can only access Google tools using accounts from the specified domains (to allow gmail or googlemail accounts, add consumer_accounts to the list of domains). This setting prevents users from signing in and adding a Secondary Account on a managed device that requires Google authentication, if that account doesn't belong to one of the explicitly allowed domains. Leaving this setting empty or unset means users can access Google Workspace with any account. Users cannot change or override this setting. Note: This policy causes the X-GoogApps-Allowed-Domains header to be appended to all HTTP and HTTPS requests to all google.com domains, as described in https://support.google.com/a/answer/1668854. Example value: managedchrome.com,example.com

Configuring this policy allows to specify which variations are allowed to be applied in Google Chrome. Variations provide a means for offering modifications to Google Chrome without shipping a new version of the browser by selectively enabling or disabling already existing features. See https://support.google.com/chrome/a?p=Manage_the_Chrome_variations_framework for more information. Setting the VariationsEnabled (value 0), or leaving the policy not set allows all variations to be applied to the browser. Setting the CriticalFixesOnly (value 1), allows only variations considered critical security or stability fixes to be applied to Google Chrome. Setting the VariationsDisabled (value 2), prevent all variations from being applied to the browser. Please note that this mode can potentially prevent the Google Chrome developers from providing critical security fixes in a timely manner and is thus not recommended.

Setting the policy turns off enforcement of Certificate Transparency disclosure requirements for a list of subjectPublicKeyInfo hashes. Enterprise hosts can keep using certificates that otherwise wouldn't be trusted (because they weren't properly publicly disclosed). To turn off enforcement, the hash must meet one of these conditions: * It's of the server certificate's subjectPublicKeyInfo. * It's of a subjectPublicKeyInfo that appears in a Certificate Authority (CA) certificate in the certificate chain. That CA certificate is constrained through the X.509v3 nameConstraints extension, one or more directoryName nameConstraints are present in the permittedSubtrees, and the directoryName has an organizationName attribute. * It's of a subjectPublicKeyInfo that appears in a CA certificate in the certificate chain, the CA certificate has one or more organizationName attributes in the certificate Subject, and the server's certificate has the same number of organizationName attributes, in the same order, and with byte-for-byte identical values. Specify a subjectPublicKeyInfo hash by linking the hash algorithm name, a slash, and the Base64 encoding of that hash algorithm applied to the DER-encoded subjectPublicKeyInfo of the specified certificate. Base64 encoding format matches that of an SPKI Fingerprint. The only recognized hash algorithm is sha256; others are ignored. Leaving the policy unset means that if certificates requiring disclosure through Certificate Transparency aren't disclosed, then Google Chrome doesn't trust those certificates. Example value: sha256/AAAAAAAAAAAAAAAAAAAAAA== sha256//////////////////////w==

Setting the policy turns off Certificate Transparency disclosure requirements for the hostnames in the specified URLs. While making it harder to detect misissued certificates, hosts can keep using certificates that otherwise wouldn't be trusted (because they weren't properly publicly disclosed). Leaving the policy unset means that if certificates requiring disclosure through Certificate Transparency aren't disclosed, then Google Chrome doesn't trust those certificates. A URL pattern follows this format ( https://support.google.com/chrome/a?p=url_blocklist_filter_format ). However, because the validity of certificates for a given hostname is independent of the scheme, port, or path, Google Chrome only considers the hostname portion of the URL. Wildcard hosts aren't supported. Example value: example.com .example.com

You can enable this policy to create a dictionary of file type extensions with a corresponding list of domains that will be exempted from file type extension-based download warnings. This lets enterprise administrators block file type extension-based download warnings for files that are associated with a listed domain. For example, if the "jnlp" extension is associated with "website1.com", users would not see a warning when downloading "jnlp" files from "website1.com", but see a download warning when downloading "jnlp" files from "website2.com". Files with file type extensions specified for domains identified by this policy will still be subject to non-file type extension-based security warnings such as mixed-content download warnings and Safe Browsing warnings. If you disable this policy or don't configure it, file types that trigger extension-based download warnings will show warnings to the user. If you enable this policy: * The URL pattern should be formatted according to https://chromeenterprise.google/policies/url-patterns/. * The file type extension entered must be in lower-cased ASCII. The leading separator should not be included when listing the file type extension, so list "jnlp" should be used instead of ".jnlp". Example: The following example value would prevent file type extension-based download warnings on "exe" and "jnlp" extensions for *.example.com domains, and on "swf" extensions for all domains. It will show the user a file type extension-based download warning on any other domain for exe and jnlp files, but not for swf files. [ { "file_extension": "jnlp", "domains": ["example.com"] }, { "file_extension": "exe", "domains": ["example.com"] }, { "file_extension": "swf", "domains": ["*"] } ] Note that while the preceding example shows the suppression of file type extension-based download warnings for "swf" files for all domains, applying suppression of such warnings for all domains for any dangerous file type extension is not recommended due to security concerns. It is shown in the example merely to demonstrate the ability to do so. If this policy is enabled alongside DownloadRestrictions, then the exemptions to file type extension-based warnings specified by this policy take precedence over a DownloadRestrictions setting that would block dangerous file types. The exemptions specified by this policy only apply to the "block dangerous file types" behavior specified by values 1 and 2 of DownloadRestrictions. For example, if this policy specifies an exemption for "exe" downloads from "website1.com", and DownloadRestrictions is set to block malicious downloads and dangerous file types (value 1), then "exe" downloads from "website1.com" will be exempt from file type extension-based blocking but will still be blocked if they are malicious. More information about DownloadRestrictions can be found at https://chromeenterprise.google/policies/?policy=DownloadRestrictions. See https://chromeenterprise.google/policies/?policy=ExemptDomainFileTypePairsFromFileTypeDownloadWarnings for more information about schema and formatting. Example value: [ { "domains": [ "https://example.com", "example2.com" ], "file_extension": "jnlp" }, { "domains": [ "*" ], "file_extension": "swf" } ]

Setting the policy to Enabled means browsing history is not saved, tab syncing is off and users can't change this setting. Setting the policy to Disabled or leaving it unset saves browsing history.

Setting the policy to True (or setting HardwareAccelerationModeEnabled to False) prevents webpages from accessing the WebGL API. Setting the policy to False or leaving it unset lets webpages use the WebGL API, but the browser's default settings might still require command line arguments to use these APIs.

Setting the policy to Enabled turns off data synchronization in Google Chrome using Google-hosted synchronization services. To fully turn off Chrome Sync services, we recommend that you turn off the service in the Google Admin console. If the policy is set to Disabled or not set, users are allowed to choose whether to use Chrome Sync. Note: Do not turn on this policy when RoamingProfileSupportEnabled is Enabled, because that feature shares the same client-side functionality. The Google-hosted synchronization is off completely in this case.

Setting the policy to Enabled disallows screenshots taken with keyboard shortcuts or extension APIs. Setting the policy to Disabled or not set allows screenshots. Note that on Microsoft® Windows®, macOS and Linux, this does not prevent screenshots that are taken with operating system or third party applications.

This policy configures a local switch that can be used to disable DNS interception checks. The checks attempt to discover whether the browser is behind a proxy that redirects unknown host names. This detection may not be necessary in an enterprise environment where the network configuration is known, since it causes some amount of DNS and HTTP traffic on start-up and each DNS configuration change. When this policy is not set, or is enabled, the DNS interception checks are performed. When explicitly disabled, they're not.

This policy controls the dynamic code settings for Google Chrome. Disabling dynamic code improves the security of Google Chrome by preventing potentially hostile dynamic code and third-party code from making changes to Google Chrome's behavior, but might cause compatibility issues with third-party software (e.g. certain printer drivers) that must run inside the browser process. If the policy is set to 0 - Default or left unset then Google Chrome will use the default settings. If the policy is set to 1 - DisabledForBrowser then the Google Chrome browser process will be prevented from creating dynamic code. Note: Read more about process mitigation policies ( https://chromium.googlesource.com/chromium/src/+/HEAD/docs/design/sandbox.md#Process-mitigation-policies ).

This policy controls whether the browser uses adaptive buffering for Web Audio, which may decrease audio glitches but may increase latency by a variable amount. Setting the policy to Enabled will always use adaptive buffering. Setting the policy to Disabled or not set will allow the browser feature launch process to decide if adaptive buffering is used.

If this policy is set to true or not configured, Google Chrome and Lacros will allow to add a new person from the user manager. If this policy is set to false, Google Chrome and Lacros will not allow adding a new person from the user manager.

This policy controls whether users enrolled in the Advanced Protection program receive extra protections. Some of these features may involve the sharing of data with Google (for example, Advanced Protection users will be able to send their downloads to Google for malware scanning). If set to True or not set, enrolled users will receive extra protections. If set to False, Advanced Protection users will receive only the standard consumer features.

Setting the policy to True means Google Chrome uses alternate error pages built into (such as "page not found"). Setting the policy to False means Google Chrome never uses alternate error pages. If you set the policy, users can't change it. If not set, the policy is on, but users can change this setting.

Configuring this policy will allow/disallow ambient authentication for Incognito and Guest profiles in Google Chrome. Ambient Authentication is http authentication with default credentials if explicit credentials are not provided via NTLM/Kerberos/Negotiate challenge/response schemes. Setting the RegularOnly (value 0), allows ambient authentication for Regular sessions only. Incognito and Guest sessions wouldn't be allowed to ambiently authenticate. Setting the IncognitoAndRegular (value 1), allows ambient authentication for Incognito and Regular sessions. Guest sessions wouldn't be allowed to ambiently authenticate. Setting the GuestAndRegular (value 2), allows ambient authentication for Guest and Regular sessions. Incognito sessions wouldn't be allowed to ambiently authenticate. Setting the All (value 3), allows ambient authentication for all sessions. Note that, ambient authentication is always allowed on regular profiles. In Google Chrome version 81 and later, if the policy is left not set, ambient authentication will be enabled in regular sessions only.

Setting the policy to Enabled or leaving it unset binds encryption keys used for local data storage to Google Chrome whenever that is possible. Setting the policy to Disabled has a detrimental effect on Google Chrome's security as unknown and potentially hostile apps can retrieve encryption keys used to secure data. Only turn off the policy if there are compatibility issues, such as other applications that need legitimate access to Google Chrome's data, encrypted user data is expected to be fully portable between different computers or the integrity and location of Google Chrome's executable files is not consistent.

Setting the policy to True or leaving it unset gives users control of Autofill for addresses in the UI. Setting the policy to False means Autofill never suggests or fills address information, nor does it save additional address information that users submit while browsing the web.

Setting the policy to True or leaving it unset means users can control autofill suggestions for credit cards in the UI. Setting the policy to False means autofill never suggests or fills credit card information, nor will it save additional credit card information that users might submit while browsing the web.

Google Chrome attempts to upgrade some navigations from HTTP to HTTPS, when possible. This policy can be used to disable this behavior. If set to "true" or left unset, this feature will be enabled by default. The separate HttpAllowlist policy can be used to exempt specific hostnames or hostname patterns from being upgraded to HTTPS by this feature. See also the HttpsOnlyMode policy.

This policy enables or disables the Battery Saver Mode setting. On Chrome, this setting makes it so that frame rate is throttled to lower power consumption. If this policy is unset, the end user can control this setting in chrome://settings/performance. On ChromeOS, this setting makes it so that frame rate and CPU frequency are throttled, backlights are dimmed, and Android is put in Battery Saver Mode. On devices with multiple CPUs, some CPUs will be turned off. The different levels are: Disabled (0): Battery Saver Mode will be disabled. EnabledBelowThreshold (1): Battery Saver Mode will be enabled when the device is on battery power and battery level is low. EnabledOnBattery (2): This value is deprecated as of M121. From M121 onwards, values will be treated as EnabledBelowThreshold.

Setting the policy to True displays a bookmark bar in Google Chrome. Setting the policy to False means users never see the bookmark bar. If you set the policy, users can't change it. If not set, users decide whether to use this function.

Enables component updates for all components in Google Chrome when not set or set to enabled. If set to disabled, updates to components are disabled. However, some components are exempt from this policy: updates to any component that does not contain executable code and is critical for the security of the browser will not be disabled. Examples of such components include the certificate revocation lists and subresource filters.

Setting the policy to Enabled or leaving it unset means browser history and download history can be deleted in Chrome, and users can't change this setting. Setting the policy to Disabled means browser history and download history can't be deleted. Even with this policy off, the browsing and download history are not guaranteed to be retained. Users may be able to edit or delete the history database files directly, and the browser itself may expire or archive any or all history items at any time.

Setting the policy to True or leaving it unset lets users share or save the current webpage using actions provided by the desktop sharing hub. The sharing hub is accessed through either an omnibox icon or the 3-dot menu. Setting the policy to False removes the sharing icon from the omnibox and the entry from the 3-dot menu.

Setting the policy to Disabled prevents users from ending processes in the Task Manager. Setting the policy to Enabled or leaving it unset lets users end processes in the Task Manager.

SharedWorkers can have an extended lifetime if the "extendedLifetime" option is set to true in the SharedWorker constructor. If this policy is set to Enabled or left unset, SharedWorkers can have an extended lifetime. If this policy is set to Disabled, SharedWorkers cannot have an extended lifetime, even if the option is set to true. This policy is intended to be temporary and will be removed in the future.

The Get Image Descriptions from Google accessibility feature enables visually-impaired screen reader users to get descriptions of unlabeled images on the web. Users who choose to enable it will have the option of using an anonymous Google service to provide automatic descriptions for unlabeled images they encounter on the web. If this feature is enabled, the content of images will be sent to Google servers in order to generate a description. No cookies or other user data is sent, and Google does not save or log any image content. If this policy is set to Enabled, the Get Image Descriptions from Google feature will be enabled, though it will only affect users who are using a screen reader or other similar assistive technology. If this policy is set to Disabled, users will not have the option of enabling the feature. If this policy is not set, user can choose to use this feature or not.

This policy configures a single global per profile cache with HTTP server authentication credentials. If this policy is unset or disabled, the browser will use the default behavior of cross-site auth, this behavior will be to scope HTTP server authentication credentials by top-level site, so if two sites use resources from the same authenticating domain, credentials will need to be provided independently in the context of both sites. Cached proxy credentials will be reused across sites. If the policy is enabled, HTTP auth credentials entered in the context of one site will automatically be used in the context of another. Enabling this policy leaves sites open to some types of cross-site attacks, and allows users to be tracked across sites even without cookies by adding entries to the HTTP auth cache using credentials embedded in URLs. This policy is intended to give enterprises depending on the legacy behavior a chance to update their login procedures, and will be removed in the future.

If set to Enabled or not set, Google Search Side Panel is allowed on all web pages. If set to Disabled, Google Search Side Panel is not available on any webpage. GenAI capabilities that are part of this feature are not available for Educational or Enterprise accounts.

If this policy is set to Enabled or not configured, Google Chrome will enable guest logins. Guest logins are Google Chrome profiles where all windows are in incognito mode. If this policy is set to Disabled, Google Chrome will not allow guest profiles to be started.

This policy enables or disables the High Efficiency Mode setting. This setting makes it so that tabs are discarded after some period of time in the background to reclaim memory. If this policy is unset, the end user can control this setting in chrome://settings/performance.

Setting the policy to Enabled mandates Chrome Enterprise Core browser enrollment and blocks Google Chrome launch process if failed. Setting the policy to Disabled or leaving it unset renders Chrome Enterprise Core browser enrollment optional and doesn't block Google Chrome launch process if failed. Machine scope cloud policy enrollment on desktop uses this policy. See https://support.google.com/chrome/a/answer/9301891 for details.

By default the browser will show media recommendations that are personalized to the user. Setting this policy to Disabled will result in these recommendations being hidden from the user. Setting this policy to Enabled or leaving it unset will result in the media recommendations being shown to the user.

This policy controls network prediction in Google Chrome. It controls DNS prefetching, TCP, and SSL preconnection and prerendering of webpages. If you set the policy, users can't change it. Leaving it unset turns on network prediction, but the user can change it.

Setting the policy to True means online OCSP/CRL checks are performed. Setting the policy to False or leaving it unset means Google Chrome won't perform online revocation checks in Google Chrome 19 and later. Note: OCSP/CRL checks provide no effective security benefit.

Controls whether Web Workers created from data URLs are assigned a unique opaque origin. Web Workers can be created using a data URL containing the worker's script. Previously, these workers inherited the origin of the page that created them, allowing them to access the same local storage, cookies, and other origin-bound data. To improve security and align with the HTML specification, Chrome is changing its default behavior in milestone 149 so that workers created from data URLs will now have a unique, opaque origin. This isolates them from the creator page's data. If this policy is set to Enabled or left unset, the new default (more secure) behavior is used, and Web Workers created from data URLs will have a unique opaque origin. If this policy is set to Disabled, Chrome reverts to the legacy behavior, and Web Workers created from data URLs will inherit the origin of their creator. This allows administrators to temporarily resolve compatibility issues if internal applications break due to the security change. This policy is intended to be temporary and will be removed in milestone 157.

Setting the policy to True or leaving it unset lets users add, remove, modify, or upload bookmarks. Setting the policy to False means users can't add, remove, modify or upload bookmarks. They can still use existing bookmarks.

Setting the policy to Enabled puts a Google web service in use to help resolve spelling errors. This policy only controls the use of the online service. Setting the policy to Disabled means this service is never used. Leaving the policy unset lets users choose whether to use the spellcheck service. The spell check can always use a downloaded dictionary locally unless the feature is disabled by SpellcheckEnabled in which case this policy will have no effect.

Controls if the PDF viewer in Google Chrome can annotate PDFs. When this policy is not set, or is set to true, then the PDF viewer will be able to annotate PDFs. When this policy is set to false, then the PDF viewer will not be able to annotate PDFs.

This policy controls the Process Isolation settings for Google Chrome. Enabling Process Isolation improves the security of Google Chrome by preventing authorized applications on the system from tampering with or reading the contents of Google Chrome's running processes. This helps prevent other applications on the system from gaining access to Google Chrome's encrypted data. Enabling Process Isolation may cause incompatibilities with third party applications that rely on being able to inject or tamper with Google Chrome's processes, such as antivirus, screen reader or window manager applications. Setting the policy to Enabled turns on process isolation in Google Chrome. Setting the policy to Disabled turns off process isolation in Google Chrome. If this policy is unset, Google Chrome will follow the default rollout process for the Process Isolation feature, which means that the feature will be gradually rolled out to an increasing number of users. Note: This policy is applied when Google Chrome starts. If the policy is changed while Google Chrome is running, the new setting will take effect on the next restart.

This policy enables the QR Code generator feature in Google Chrome. If you enable this policy or don't configure it, the QR Code Generator feature is enabled. If you disable this policy, the QR Code Generator feature is disabled.

Setting the policy to Enabled or leaving it unset means Renderer App Container configuration will be enabled on supported platforms. Setting the policy to Disabled has a detrimental effect on the security and stability of Google Chrome as it will weaken the sandbox that renderer processes use. Only turn off the policy if there are compatibility issues with third-party software that must run inside renderer processes. Note: Read more about Process mitigation policies ( https://chromium.googlesource.com/chromium/src/+/HEAD/docs/design/sandbox.md#Process-mitigation-policies ).

When this policy is Enabled, anonymous reporting of usage and crash-related data about Google Chrome to Google is recommended to be enabled by default. Users will still be able to change this setting. When this policy is Disabled, anonymous reporting is disabled and no usage or crash data is sent to Google. Users won't be able to change this setting. When this policy is not set, users can choose the anonymous reporting behavior at installation or first run, and can change this setting later. (For Google ChromeOS, see DeviceMetricsReportingEnabled.) On Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core. On macOS, this policy is only available on instances that are managed via MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.

Setting the policy to Enabled or leaving it unset means downloaded files are sent to be analyzed by Safe Browsing, even when it's from a trusted source. Setting the policy to Disabled means downloaded files won't be sent to be analyzed by Safe Browsing when it's from a trusted source. These restrictions apply to downloads triggered from webpage content, as well as the Download link menu option. These restrictions don't apply to the save or download of the currently displayed page or to saving as PDF from the printing options. On Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core.

This feature allows for hyperlinks and address bar URL navigations to target specific text within a web page, which will be scrolled to once the loading of the web page is complete. If you enable or don't configure this policy, web page scrolling to specific text fragments via URL will be enabled. If you disable this policy, web page scrolling to specific text fragments via URL will be disabled.

Setting the policy to True turns on search suggestions in Google Chrome's address bar. Setting the policy to False turns off these search suggestions. Suggestions based on bookmarks or history are unaffected by the policy. If you set the policy, users can't change it. If not set, search suggestions are on at first, but users can turn them off any time.

Setting the policy to Enabled or leaving it unset means security warnings appear when potentially dangerous command-line flags are used to launch Chrome. Setting the policy to Disabled prevents security warnings from appearing when Chrome is launched with potentially dangerous command-line flags. On Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core. On macOS, this policy is only available on instances that are managed via MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.

Setting the policy to True or leaving it unset lets Google Chrome show users product promotional content. Setting the policy to False prevents Google Chrome from showing product promotional content. Setting the policy controls the presentation of promotional content, including the welcome pages that help users sign in to Google Chrome, set Google Chrome as users' default browser, or otherwise inform them of product features.

Setting the policy to True or leaving it unset means Google Chrome will accept web contents served as Signed HTTP Exchanges. Setting the policy to False prevents Signed HTTP Exchanges from loading.

This settings enables or disables signin interception. When this policy not set or is enabled, the signin interception dialog triggers when a Google account is added on the web, and the user may benefit from moving this account to another (new or existing) profile. When this is disabled, the signin interception dialog does not trigger. When this is disabled, a dialog will still be shown if managed account profile separation is enforced by ManagedAccountsSigninRestriction.

Specify a list of origins that run in a dedicated process. On Android, this policy only works on devices with sufficient memory (strictly more than 3.2GB RAM), as isolating too many sites on resource-constrained devices may cause performance problems. For resource-constrained Android devices, please use IsolateOriginsShortlist instead. Devices with less than 1GB memory are not recommended to configure any process isolation specifically. Each named origin's process will only be allowed to contain documents from that origin and its subdomains. For example, specifying https://a1.example.com/ allows https://a2.a1.example.com/ in the same process, but not https://example.com or https://b.example.com. Since Google Chrome 77, you can also specify a range of origins to isolate using a wildcard. For example, specifying https://[*.]corp.example.com will give every origin underneath https://corp.example.com its own dedicated process, including https://corp.example.com itself, https://a1.corp.example.com, and https://a2.a1.corp.example.com. Note that all sites (i.e., scheme plus eTLD+1, such as https://example.com) are already isolated by default on Desktop platforms, as noted in the SitePerProcess policy. This IsolateOrigins policy is useful to isolate specific origins at a finer granularity (e.g., https://a.example.com). Note that Android isolates certain sensitive sites by default starting in Google Chrome version 77, and this policy extends that mode to isolate specific additional origins. Also note that origins isolated by this policy will be unable to script other origins in the same site, which is otherwise possible if two same-site documents modify their document.domain values to match. Administrators should confirm this uncommon behavior is not used on an origin before isolating it. Setting the policy to an empty string or leaving it unset means site isolation won't be required for any specific origins. Users can still turn on process isolation manually, through the command line flag. Example value: https://a.example.com/,https://othersite.org/,https://[*.]corp.example.com

Setting the policy to Enabled turns spellcheck on, and users can't turn it off. On Microsoft® Windows®, Google ChromeOS and Linux®, spellcheck languages can be switched on or off individually, so users can still turn spellcheck off by switching off every spellcheck language. To avoid that, use the SpellcheckLanguage to force-enable specific spellcheck languages. Setting the policy to Disabled turns off spellcheck from all sources, and users can't turn it on. The SpellCheckServiceEnabled, SpellcheckLanguage and SpellcheckLanguageBlocklist policies have no effect when this policy is set to False. Leaving the policy unset lets users turn spellcheck on or off in the language settings.

This policy enables conformance to the newly-adopted specification of CSS zoom. When this policy is Enabled or unset, the CSS "zoom" property will adhere to the specification: https://drafts.csswg.org/css-viewport/#zoom-property When Disabled, the CSS "zoom" property will fall back to its legacy pre-standardized behavior. This policy is a temporary reprieve to allow time to migrate web content to the new behavior. There is also an origin trial ("DisableStandardizedBrowserZoom") that corresponds to the behavior when this policy is Disabled. This policy will be removed and the "Enabled" behavior made permanent in milestone 134.

This policy enables strict MIME type checking for worker scripts. When enabled or unset, then worker scripts will use strict MIME type checking for JavaScript, which is the new default behaviour. Worker scripts with legacy MIME types will be rejected. When disabled, then worker scripts will use lax MIME type checking, so that worker scripts with legacy MIME types, e.g. text/ascii, will continue to be loaded and executed. Browsers traditionally used lax MIME type checking, so that resources with a number of legacy MIME types were supported. E.g. for JavaScript resources, text/ascii is a legacy supported MIME type. This may cause security issues, by allowing to load resources as scripts that were never intended to be used as such. Chrome will transition to use strict MIME type checking in the near future. The enabled policy will track the default behaviour. Disabling this policy allows administrators to retain the legacy behaviour, if desired. See https://html.spec.whatwg.org/multipage/scripting.html#scriptingLanguage for details about JavaScript / ECMAScript media types.

Enable the Click to Call feature which allows users to send phone numbers from Chrome Desktops to an Android device when the user is Signed-in. For more information, see help center article: https://support.google.com/chrome/answer/9430554?hl=en. If this policy is set to enabled, the capability of sending phone numbers to Android devices will be enabled for the Chrome user. If this policy is set to disabled, the capability of sending phone numbers to Android devices will be disabled for the Chrome user. If you set this policy, users cannot change or override it. If this policy is left unset, the Click to Call feature is enabled by default.

This policy controls whether or not the network service process runs sandboxed. If this policy is enabled, the network service process will run sandboxed. If this policy is disabled, the network service process will run unsandboxed. This leaves users open to additional security risks related to running the network service unsandboxed. If this policy is not set, the default configuration for the network sandbox will be used. This may vary depending on Google Chrome release, currently running field trials, and platform. This policy is intended to give enterprises flexibility to disable the network sandbox if they use third party software that interferes with the network service sandbox.

Enable the Shared Clipboard feature which allows users to send text between Chrome Desktops and an Android device when Sync is enabled and the user is Signed-in. If this policy is set to true, the capability of sending text, cross device, for chrome user is enabled. If this policy is set to false, the capability of sending text, cross device, for chrome user is disabled. If you set this policy, users cannot change or override it. If this policy is left unset, the shared clipboard feature is enabled by default. It is up to the admins to set policies in all platforms they care about. It's recommended to set this policy to one value in all platforms.

TLS 1.3 Early Data is an extension to TLS 1.3 to send an HTTP request simultaneously with the TLS handshake. If this policy is not configured, Google Chrome will follow the default rollout process for TLS 1.3 Early Data. If it is enabled, Google Chrome will enable TLS 1.3 Early Data. If it is disabled, Google Chrome will not enable TLS 1.3 Early Data. When the feature is enabled, Google Chrome may or may not use TLS 1.3 Early Data depending on server support. TLS 1.3 Early Data is an established protocol. Existing TLS servers, middleboxes, and security software are expected to either handle or reject TLS 1.3 Early Data without dropping the connection. However, devices that do not correctly implement TLS may malfunction and disconnect when TLS 1.3 Early Data is in use. If this occurs, administrators should contact the vendor for a fix. This policy is a temporary measure to control the feature and will be removed afterwards. The policy may be enabled to allow you to test for issues and disabled while issues are being resolved.

Encrypted ClientHello (ECH) is an extension to TLS to encrypt sensitive fields of the ClientHello and improve privacy. If this policy is not configured, or is set to enabled, Google Chrome will follow the default rollout process for ECH. If it is disabled, Google Chrome will not enable ECH. When the feature is enabled, Google Chrome may or may not use ECH depending on server support, availability of the HTTPS DNS record, or rollout status. ECH is an evolving protocol, so Google Chrome's implementation is subject to change. As such, this policy is a temporary measure to control the initial experimental implementation. It will be replaced with final controls as the protocol finalizes.

Setting the policy to True provides translation functionality when it's appropriate for users by showing an integrated translate toolbar in Google Chrome and a translate option on the right-click context menu. Setting the policy to False shuts off all built-in translate features. If you set the policy, users can't change this function. Leaving it unset lets them change the setting.

Setting the policy to Enabled means URL-keyed anonymized data collection, which sends URLs of pages the user visits to Google to make searches and browsing better, is always active. Setting the policy to Disabled results in no URL-keyed anonymized data collection. If this policy is left unset, the user will be able to change this setting manually. In Google ChromeOS Kiosk, this policy doesn't offer the option to "Allow the user to decide". If this policy is unset for Google ChromeOS Kiosk, URL-keyed anonymized data collection is always active. When set for Google ChromeOS Kiosk, this policy enables URL-keyed metrics collection for kiosk apps.

Enables window occlusion in Google Chrome. If you enable this setting, to reduce CPU and power consumption Google Chrome will detect when a window is covered by other windows, and will suspend work painting pixels. If you disable this setting Google Chrome will not detect when a window is covered by other windows. If this policy is left not set, occlusion detection will be enabled.

Setting the policy to Enabled or leaving it unset turns on WPAD (Web Proxy Auto-Discovery) optimization in Google Chrome. Setting the policy to Disabled turns off WPAD optimization, causing Google Chrome to wait longer for DNS-based WPAD servers. Whether or not this policy is set, users can't change the WPAD optimization setting.

Setting the policy to True lets extensions installed by enterprise policy use the Enterprise Hardware Platform API. Setting the policy to False or leaving it unset prevents extensions from using this API. Note: This policy also applies to component extensions, such as the Hangout Services extension.

Setting the policy to Enabled allows policies associated with a managed account to be merged into machine-level policies. Setting the policy to Disabled or leaving it unset prevents user-level cloud policies from being merged with policies from any other sources. Only policies originating from secure users can take precedence. A secure user is affiliated with the organization that manages their browser using Chrome Enterprise Core. All other user-level policies will have default precedence. Policies that need to be merged also need to be set in either PolicyListMultipleSourceMergeList or PolicyDictionaryMultipleSourceMergeList. This policy will be ignored if neither of the two aforementioned policies is configured.

Setting the policy to Enabled means Google Chrome enforces guest sessions and prevents profile sign-ins. Guest sign-ins are Google Chrome profiles where windows are in Incognito mode. Setting the policy to Disabled, leaving it unset, or disabling browser Guest mode (through BrowserGuestModeEnabled) allows the use of new and existing profiles.

This policy allows administrators to set a designated enterprise search aggregator that will provide search recommendations and results within the omnibox (address bar) and the search box on the New Tab page. By default, enterprise search suggestions will be blended and shown alongside regular Google Chrome recommendations. Users can explicitly scope their search to just the enterprise search aggregator by typing the keyword specified in the shortcut field with or without the @ prefix (e.g. @work) followed by Space or Tab in the omnibox. Scoped enterprise searches (triggered by a keyword) are currently only supported in the omnibox and not in the search box on the New Tab page. The following fields are required: name, shortcut, search_url, suggest_url. The name field corresponds to the search engine name shown to the user in the address bar. The shortcut field corresponds to the keyword that the user enters to trigger the search. The shortcut can include plain words and characters, but cannot include spaces or start with the @ symbol. Shortcuts must be unique. The search_url field specifies the URL on which to search. Enter the web address for the search engine's results page, and use '{searchTerms}' in place of the query. The suggest_url field specifies the URL that provides search suggestions. A POST request will be made and the user's query will be passed in the POST params under key 'query'. The icon_url field specifies the URL to an image that will be used on the search suggestions. A default icon will be used when this field is not set. It's recommended to use a favicon (example https://www.google.com/favicon.ico). Supported image file formats: JPEG, PNG, and ICO. The require_shortcut field specifies whether the address bar shortcut is required to see search recommendations. If required, suggestions will not be shown in the search box on the New Tab page, but will continue to be shown in the omnibox (address bar) in scoped search mode. If this field is not set, the address bar shortcut is not required. On Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core. On macOS, this policy is only available on instances that are managed via MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core. See https://chromeenterprise.google/policies/?policy=EnterpriseSearchAggregatorSettings for more information about schema and formatting. Example value: { "name": "My Search Aggregator", "shortcut": "work", "search_url": "https://www.aggregator.com/search?q={searchTerms}", "suggest_url": "https://www.aggregator.com/suggest", "icon_url": "https://www.google.com/favicon.ico", "require_shortcut": true }

If set to enabled this policy forces the profile to be switched to ephemeral mode. If this policy is specified as an OS policy (e.g. GPO on Windows) it will apply to every profile on the system; if the policy is set as a Cloud policy it will apply only to a profile signed in with a managed account. In this mode the profile data is persisted on disk only for the length of the user session. Features like browser history, extensions and their data, web data like cookies and web databases are not preserved after the browser is closed. However this does not prevent the user from downloading any data to disk manually, save pages or print them. If the user has enabled sync all this data is preserved in their sync profile just like with regular profiles. Incognito mode is also available if not explicitly disabled by policy. If the policy is set to disabled or left not set signing in leads to regular profiles.

There is a list of restricted ports built into Google Chrome. Connections to these ports will fail. This setting permits bypassing that list. The value is a comma-separated list of zero or more ports that outgoing connections will be permitted on. Ports are restricted to prevent Google Chrome being used as a vector to exploit various network vulnerabilities. Setting this policy may expose your network to attacks. This policy is intended as a temporary workaround for errors with code "ERR_UNSAFE_PORT" while migrating a service running on a blocked port to a standard port (ie. port 80 or 443). Malicious websites can easily detect that this policy is set, and for what ports, and use that information to target attacks. Each port here is labelled with a date that it can be unblocked until. After that date the port will be restricted regardless of this setting. Leaving the value empty or unset means that all restricted ports will be blocked. If there is a mixture of valid and invalid values, the valid ones will be applied. This policy overrides the "--explicitly-allowed-ports" command-line option. Example value: 10080

Force-disables spellcheck languages. Unrecognized languages in that list will be ignored. If you enable this policy, spellcheck will be disabled for the languages specified. The user can still enable or disable spellcheck for languages not in the list. If you do not set this policy, or disable it, there will be no change to the user's spellcheck preferences. If the SpellcheckEnabled policy is set to false, this policy will have no effect. If a language is included in both this policy and the SpellcheckLanguage policy, the latter is prioritized and the spellcheck language will be enabled. The currently supported languages are: af, bg, ca, cs, da, de, el, en-AU, en-CA, en-GB, en-US, es, es-419, es-AR, es-ES, es-MX, es-US, et, fa, fo, fr, he, hi, hr, hu, id, it, ko, lt, lv, nb, nl, pl, pt-BR, pt-PT, ro, ru, sh, sk, sl, sq, sr, sv, ta, tg, tr, uk, vi. Example value: fr es

Force-enables spellcheck languages. Unrecognized languages in the list will be ignored. If you enable this policy, spellcheck will be enabled for the languages specified, in addition to the languages for which the user has enabled spellcheck. If you do not set this policy, or disable it, there will be no change to the user's spellcheck preferences. If the SpellcheckEnabled policy is set to false, this policy will have no effect. If a language is included in both this policy and the SpellcheckLanguageBlocklist policy, this policy is prioritized and the spellcheck language is enabled. The currently supported languages are: af, bg, ca, cs, da, de, el, en-AU, en-CA, en-GB, en-US, es, es-419, es-AR, es-ES, es-MX, es-US, et, fa, fo, fr, he, hi, hr, hu, id, it, ko, lt, lv, nb, nl, pl, pt-BR, pt-PT, ro, ru, sh, sk, sl, sq, sr, sv, ta, tg, tr, uk, vi. Example value: fr es

This policy controls whether background web content is forced to run at foreground priority. By default, the browser optimizes resources by deprioritizing content in background tabs. Enabling this policy overrides that behavior, causing background tabs to be scheduled the same way as the active tab. Note that forcing background content to run at foreground priority may slightly impact the responsiveness of the active tab. If this policy is set to Enabled, all web content runs at foreground priority regardless of its visibility state. If this policy is set to Disabled or not set, the browser determines priority based on standard heuristics (e.g., deprioritizing content that is not visible, not playing audio, not participating in video calls...).

This policy allows you to specify a list of URL patterns. Background web content matching these patterns will be forced to run at foreground priority. If the ForceForegroundPriorityForAllTabs policy is enabled, this list is ignored as all tabs will be forced to foreground priority. If ForceForegroundPriorityForAllTabs is disabled or unset, only content matching the patterns in this list will be forced. For detailed information on valid URL patterns, please see https://support.google.com/chrome/a?p=url_blocklist_filter_format. If this list is empty or not set, no background content is forced to foreground priority. Example value: https://www.example.com/path?query=val example.edu https://example.com:8080 *://example.org:*/

Setting the policy to Enabled means SafeSearch in Google Search is always active, and users can't change this setting. Setting the policy to Disabled or leaving it unset means SafeSearch in Google Search is not enforced.

This policy controls whether native host executables launch directly on Windows. Setting the policy to Enabled forces Google Chrome to launch native messaging hosts implemented as executables directly. Setting the policy to Disabled will result in Google Chrome launching hosts using cmd.exe as an intermediary process. Leaving the policy unset allows Google Chrome to decide which approach to use.

Setting the policy to Enabled means cloud policy takes precedence if it conflicts with platform policy. Setting the policy to Disabled or leaving it unset means platform policy takes precedence if it conflicts with cloud policy. This mandatory policy affects machine scope cloud policies. This policy is specific to Google Chrome and does not affect Google Update because they are independent applications. Google Update has a separate policy with the same name.

Hide the Chrome Web Store app and footer link from the New Tab Page and Google ChromeOS app launcher. When this policy is set to true, the icons are hidden. When this policy is set to false or is not configured, the icons are visible.

Setting the policy to Enabled imports autofill form data from the previous default browser on first run. Setting the policy to Disabled or leaving it unset means no autofill form data is imported on first run. Users can trigger an import dialog and the autofill form data checkbox will be checked or unchecked to match this policy's value.

Setting the policy to Enabled imports bookmarks from the previous default browser on first run. Setting the policy to Disabled or leaving it unset means no bookmarks are imported on first run. Users can trigger an import dialog and the bookmarks checkbox will be checked or unchecked to match this policy's value.

Setting the policy to Enabled imports browsing history from the previous default browser on first run. Setting the policy to Disabled or leaving it unset means no browsing history is imported on first run. Users can trigger an import dialog and the browsing history checkbox will be checked or unchecked to match this policy's value.

Setting the policy to Enabled imports the homepage from the previous default browser on first run. Setting the policy to Disabled or leaving it unset means the homepage isn't imported on first run. Users can trigger an import dialog and the homepage checkbox will be checked or unchecked to match this policy's value.

This policy controls only the first run import behavior after installation. It enables more seamless transition to Google Chrome in environments where a different browser was extensively used prior to installing the browser. This policy does not affect password manager capabilities for Google accounts. Setting the policy to Enabled imports saved passwords from the previous default browser on first run and manual importing from the settings page is also possible. Setting the policy to Disabled means no saved passwords are imported on first run and manual importing from the Settings page is blocked. Leaving the policy unset means no saved passwords are imported on first run but the user can choose to do that from the settings page.

Setting the policy to Enabled imports the default search engine from the previous default browser on first run. Setting the policy to Disabled or leaving it unset means the default search engine isn't imported on first run. Users can trigger an import dialog and the default search engine checkbox will be checked or unchecked to match this policy's value.

Specifies whether the user may open pages in Incognito mode in Google Chrome. If 'Enabled' is selected or the policy is left unset, pages may be opened in Incognito mode. If 'Disabled' is selected, pages may not be opened in Incognito mode. If 'Forced' is selected, pages may be opened ONLY in Incognito mode. Note that 'Forced' does not work for Android-on-Chrome The IncognitoModeUrlAllowlist policy takes precedence over this policy and can re-enable Incognito mode for specific URLs. When Incognito mode is disabled by this policy when an allowlist is provided, Incognito mode is available only for URLs matching the allowlist, while all other pages are blocked. Note: On iOS, if the policy is changed during a session, it will only take effect on relaunch.

This policy configures behavior for intranet redirection via DNS interception checks. The checks attempt to discover whether the browser is behind a proxy that redirects unknown host names. If this policy is not set, the browser will use the default behavior of DNS interception checks and intranet redirect suggestions. In M88, they are enabled by default but will be disabled by default in the future release. DNSInterceptionChecksEnabled is a related policy that may also disable DNS interception checks; this policy is a more flexible version which may separately control intranet redirection infobars and may be expanded in the future. If either DNSInterceptionChecksEnabled or this policy requests to disable interception checks, the checks will be disabled.

If this policy is Enabled, the option to keep any existing browsing data when creating an enterprise profile will be checked by default. If this policy is unset or Disabled, the option to keep any existing browsing data when creating an enterprise profile will not be checked by default. Regardless of the value, the user will be able to decide whether or not to keep any existing browsing data when creating an enterprise profile. This policy has no effect if the option to keep existing browsing data is not available; this happens if enterprise profile separation is strictly enforced, or if the data would be from an already managed profile.

Following each major version update, Chrome will create a snapshot of certain portions of the user's browsing data for use in case of a later emergency version rollback. If an emergency rollback is performed to a version for which a user has a corresponding snapshot, the data in the snapshot is restored. This allows users to retain such settings as bookmarks and autofill data. If this policy is not set, the default value of 3 is used If the policy is set, old snapshots are deleted as needed to respect the limit. If the policy is set to 0, no snapshots will be taken

This policy can be used to allow Chrome DevTools on specific URLs. URL patterns are matched against the URL of every frame on the page being inspected. The resulting behavior depends on whether the DeveloperToolsAvailabilityBlocklist policy is also set. If this policy is set and DeveloperToolsAvailabilityBlocklist is not, every frame's URL must match a pattern on this allowlist for Chrome DevTools to be allowed. If any frame's URL does not match, DevTools will be blocked for the entire page. For information on the URL format, see https://support.google.com/chrome/a?p=url_blocklist_filter_format. If both this and the DeveloperToolsAvailabilityBlocklist policies are set, this allowlist takes precedence. If a frame's URL matches a pattern on this allowlist, it will be allowed, even if it also matches a pattern in the blocklist. If a URL matches a pattern on the blocklist (but not the allowlist), it will be blocked. If a URL matches neither, the DeveloperToolsAvailability policy will be used as a fallback. If this policy is not set, the availability of Chrome DevTools is determined by the DeveloperToolsAvailabilityBlocklist and DeveloperToolsAvailability policies. This policy also applies to Chrome DevTools opened for extensions and web applications. This policy is limited to 1,000 entries. Example value: example.com https://ssl.server.com hosting.com/bad_path https://server:8080/path .exact.hostname.com file://*

This policy can be used to block Chrome DevTools on specific URLs. For information on the URL format, see https://support.google.com/chrome/a?p=url_blocklist_filter_format. URL patterns are matched against the URL of every frame on the page being inspected. The resulting behavior depends on whether the DeveloperToolsAvailabilityAllowlist policy is also set. If this policy is set and DeveloperToolsAvailabilityAllowlist is not, any frame's URL matching a pattern on this blocklist will block Chrome DevTools for the entire page. If a frame's URL doesn't match any pattern, the availability is determined by the DeveloperToolsAvailability policy. If both this and the DeveloperToolsAvailabilityAllowlist policies are set, the allowlist takes precedence. If a frame's URL matches a pattern on the allowlist, it will be allowed, even if it also matches a pattern in this blocklist. If a URL matches a pattern on this blocklist (but not the allowlist), it will be blocked. If a URL matches neither, the DeveloperToolsAvailability policy will be used as a fallback. If this policy is not set, the availability of Chrome DevTools is determined by the DeveloperToolsAvailabilityAllowlist and DeveloperToolsAvailability policies. This policy is limited to 1,000 entries. Example value: https://example.com example.com https://ssl.server.com hosting.com/bad_path https://server:8080/path .exact.hostname.com * file://*

Upon https://w3c.github.io/ServiceWorker/#control-and-use-worker-client, workers should inherit controllers for the blob URL. However, existing code allows only DedicatedWorkers to inherit the controller, and SharedWorkers do not inherit the controller. Setting the policy to Enabled or leaving it unset means Google Chrome inherit the controller if a blob URL is used as a SharedWorker URL. Setting the policy to Disabled leaves the behavior not aligned with the specification as-is. This policy is intended to be temporary and will be removed in the future.

Setting the policy specifies the maximal number of simultaneous connections per proxy server for non-WebSocket requests. To modify WebSocket request limits, see MaxConnectionsPerProxyForWebSocket. Leaving the policy unset means a default of 128 is used. Some web apps are known to consume many connections with hanging GETs, so setting a value below 128 may lead to browser networking hangs if there are too many web apps with hanging connections open. Some proxy servers can't handle a high number of concurrent connections per client, which is solved by setting this policy to a lower value. The value should be equal to or higher than 6. Setting a value below that limit will cause 6 to be used. Lower below the default (128) at your own risk. The value should be equal to or lower than 256 (99 in Google Chrome 147 and earlier). Setting a value above that limit will cause 256 (99 in Google Chrome 147 and earlier) to be used. Raise above the default (128) at your own risk. Please note that the enforced limits are impacted by AllowSocketPoolSizeRandomizationForProxies.

Setting the policy specifies the maximal number of simultaneous connections per proxy server for WebSocket requests. To modify non-WebSocket request limits, see MaxConnectionsPerProxy. Leaving the policy unset means a default of 128 is used. Some web apps are known to consume many connections with hanging GETs, so setting a value below 128 may lead to browser networking hangs if there are too many web apps with hanging connections open. Some proxy servers can't handle a high number of concurrent connections per client, which is solved by setting this policy to a lower value. The value should be equal to or higher than 6. Setting a value below that limit will cause 6 to be used. Lower below the default (128) at your own risk. The value should be equal to or lower than 256. Setting a value above that limit will cause 256 to be used. Raise above the default (128) at your own risk. Please note that the enforced limits are impacted by AllowSocketPoolSizeRandomizationForProxies.

Setting the policy specifies the maximum delay in milliseconds between receiving a policy invalidation and fetching the new policy from the device management service. Valid values range from 1,000 (1 second) to 300,000 (5 minutes). Values outside this range will be clamped to the respective boundary. Leaving the policy unset means Google Chrome uses the default value of 10 seconds.

Notify users that Google Chrome must be relaunched or Google ChromeOS must be restarted to apply a pending update. This policy setting enables notifications to inform the user that a browser relaunch or device restart is recommended or required. If not set, Google Chrome indicates to the user that a relaunch is needed via subtle changes to its menu, while Google ChromeOS indicates such via a notification in the system tray. If set to 'Recommended', a recurring warning will be shown to the user that a relaunch is recommended. The user can dismiss this warning to defer the relaunch. If set to 'Required', a recurring warning will be shown to the user indicating that a browser relaunch will be forced once the notification period passes. The default period is seven days for Google Chrome and four days for Google ChromeOS, and may be configured via the RelaunchNotificationPeriod policy setting. The user's session is restored following the relaunch/restart.

Setting this policy allows enterprises to override the value returned by the CPU Performance API (i.e., navigator.cpuPerformance, please see https://github.com/WICG/cpu-performance for details). If this policy is set, the value of navigator.cpuPerformance will be overridden to the specified value. If the policy is not set, then the default performance tier calculation is used. The possible values for this policy are 0 to 4.

Specifies whether the profile picker is enabled, disabled or forced at the browser startup. By default the profile picker is not shown if the browser starts in guest or incognito mode, a profile directory and/or urls are specified by command line, an app is explicitly requested to open, the browser was launched by a native notification, there is only one profile available or the policy ForceBrowserSignin is set to true. If 'Enabled' (0) is selected or the policy is left unset, the profile picker will be shown at startup by default, but users will be able to enable/disable it. If 'Disabled' (1) is selected, the profile picker will never be shown, and users will not be able to change the setting. If 'Forced' (2) is selected, the profile picker cannot be suppressed by the user. The profile picker will be shown even if there is only one profile available.

When set to DoNotPrompt or left unset, Google Chrome does not automatically prompt the user to re-authenticate to the browser. When set to PromptInTab, when the user's authentication expires, immediately open a new tab with the Google login page. This only happens if using Chrome Sync.

This policy controls whether the user is prompted to select a client certificate when more than one certificate matches AutoSelectCertificateForUrls. If this policy is set to Enabled, the user is prompted to select a client certificate whenever the auto-selection policy matches multiple certificates. If this policy is set to Disabled or not set, the user may only be prompted when no certificate matches the auto-selection.

Setting the policy configures the proxy settings for Chrome and ARC-apps, which ignore all proxy-related options specified from the command line. Leaving the policy unset lets users choose their proxy settings. Setting the ProxySettings policy accepts the following fields: * ProxyMode, which lets you specify the proxy server Chrome uses and prevents users from changing proxy settings * ProxyPacUrl, a URL to a proxy .pac file, or a PAC script encoded as a data URL with MIME type application/x-ns-proxy-autoconfig * ProxyPacMandatory, which prevents the network stack from falling back to direct connections with invalid or unavailable PAC script * ProxyServer, a URL of the proxy server * ProxyBypassList, a list of hosts for which the proxy will be bypassed The ProxyServerMode field is deprecated in favor of the ProxyMode field. For ProxyMode, if you choose the value: * direct, a proxy is never used and all other fields are ignored. * system, the systems's proxy is used and all other fields are ignored. * auto_detect, all other fields are ignored. * fixed_servers, the ProxyServer and ProxyBypassList fields are used. * pac_script, the ProxyPacUrl, ProxyPacMandatory and ProxyBypassList fields are used. Note: For more detailed examples, visit The Chromium Projects ( https://www.chromium.org/developers/design-documents/network-settings/#command-line-options-for-proxy-settings ). See https://chromeenterprise.google/policies/?policy=ProxySettings for more information about schema and formatting. Example value: { "ProxyBypassList": "https://www.example1.com,https://www.example2.com,https://internalsite/", "ProxyMode": "fixed_servers", "ProxyServer": "123.123.123.123:8080" }

Setting the policy specifies the period in milliseconds at which the device management service is queried for user policy information. Valid values range from 1,800,000 (30 minutes) to 86,400,000 (1 day). Values outside this range will be clamped to the respective boundary. Leaving the policy unset uses the default value of 3 hours. Note: Policy notifications force a refresh when the policy changes, making frequent refreshes unnecessary. So, if the platform supports these notifications, the refresh delay is 24 hours (ignoring defaults and the value of this policy).

Specifies the minimum release age beyond which relaunch notifications are more aggressive. The age is calculated from the time the currently-running version was last served to clients. If a browser relaunch or device restart is needed to finalize a pending update and the current version has been outdated for more than the number of days specified by this setting, the RelaunchNotificationPeriod policy is overridden to 2 hours. If the RelaunchNotification policy is set to 1 ('Required'), users will be forced to relaunch or restart at the end of the period. If not set, or if the release age cannot be determined, the RelaunchNotificationPeriod policy will be used for all updates.

Setting the policy to True means Google Chrome always performs revocation checking for successfully validated server certificates signed by locally installed CA certificates. If Google Chrome can't get revocation status information, Google Chrome treats these certificates as revoked (hard-fail). Setting the policy to False or leaving it unset means Google Chrome uses existing online revocation-checking settings. On macOS, this policy has no effect if the ChromeRootStoreEnabled policy is set to False.

Since Google Chrome 67, site isolation has been enabled by default on all Desktop platforms, causing every site to run in its own process. A site is a scheme plus eTLD+1 (e.g., https://example.com). Setting this policy to Enabled does not change that behavior; it only prevents users from opting out (for example, using Disable site isolation in chrome://flags). Since Google Chrome 76, setting the policy to Disabled or leaving it unset doesn't turn off site isolation, but instead allows users to opt out. IsolateOrigins might also be useful for isolating specific origins at a finer granularity than site (e.g., https://a.example.com). On Google ChromeOS version 76 and earlier, set the DeviceLoginScreenSitePerProcess device policy to the same value. (If the values don't match, a delay can occur when entering a user session.) Note: For Android, use the SitePerProcessAndroid policy instead.

This policy controls whether background fetch requests from Service Workers are restricted. If a feature that downloads files in the background is affected, this policy may be relevant. If this policy is set to Enabled, or left unset, the restriction is active, and background fetch requests from Service Worker contexts may be blocked. If this policy is set to Disabled, the restriction is bypassed, allowing all Service Workers to make background fetch requests. This enterprise policy is temporary, and will be removed after M152.

This policy mitigates side-channel cross process memory attacks by isolating the renderer process on the CPU core and preventing other processes from sharing the same core. The mitigation is supported on Microsoft® Windows® 11 24H2 and above. If the OS does not have the required scheduling support, this policy will have no effect. This policy may slow down performance in some demanding scenarios similar to disabling hyperthreading. For more information refer https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-process_mitigation_side_channel_isolation_policy If this policy is enabled, all other processes will not be scheduled on the same CPU core when the renderer process is running. If this policy is disabled, all other processes can be scheduled on the same CPU core if a renderer process is running on it. If this policy is not set, all other processes can be scheduled on the same CPU core if a renderer process is running on the core. This may vary depending on Google Chrome release, currently running field trials, and platform.

Contains a regular expression to determine eligible Google accounts for saving PDF files to Google Drive from the Google Chrome PDF Viewer. An error is displayed if a user tries to upload a PDF file to Google Drive using an account that does not match this pattern. If this policy is left not set or blank, then the user can use any Google account to save PDF files to Google Drive. Example value: .*@example\.com

If the policy is set, the UDP port range used by WebRTC is restricted to the specified port interval (endpoints included). If the policy is not set, or if it is set to the empty string or an invalid port range, WebRTC is allowed to use any available local UDP port. Example value: 10000-11999

Contains a regular expression which is used to determine which Google accounts can be set as browser primary accounts in Google Chrome (i.e. the account that is chosen during the Sync opt-in flow). An appropriate error is displayed if a user tries to set a browser primary account with a username that does not match this pattern. If this policy is left not set or blank, then the user can set any Google account as a browser primary account in Google Chrome. Example value: .*@example\.com

Setting the policy has Google Chrome use the directory you provide for storing cached files on the disk—whether or not users specify the --disk-cache-dir flag. If not set, Google Chrome uses the default cache directory, but users can change that setting with the --disk-cache-dir command line flag. Google Chrome manages the contents of a volume's root directory. So to avoid data loss or other errors, do not set this policy to the root directory or any directory used for other purposes. See the variables you can use ( https://www.chromium.org/administrators/policy-list-3/user-data-directory-variables ). Example value: ${user_home}/Chrome_cache

Setting the policy to None has Google Chrome use the default cache size for storing cached files on the disk. Users can't change it. If you set the policy, Google Chrome uses the cache size you provide—whether or not users specify the --disk-cache-size flag. (Values below a few megabytes are rounded up.) If not set, Google Chrome uses the default size. Users can change that setting using the --disk-cache-size flag. Note: The value specified in this policy is used as a hint to various cache subsystems in the browser. Therefore the actual total disk consumption of all caches will be higher but within the same order of magnitude as the value specified.

Setting the policy sets up the directory Chrome uses for downloading files. It uses the provided directory, whether or not users specify one or turned on the flag to be prompted for download location every time. This policy overrides the DefaultDownloadDirectory policy. Leaving the policy unset means Chrome uses the default download directory, and users can change it. On Google ChromeOS it's possible to set it only to Google Drive directories. Note: See a list of variables you can use ( https://www.chromium.org/administrators/policy-list-3/user-data-directory-variables ). Example value: /home/${user_name}/Downloads

Setting the policy to True has Google Chrome always check whether it's the default browser on startup and, if possible, automatically register itself. Setting the policy to False stops Google Chrome from ever checking if it's the default and turns user controls off for this option. Leaving the policy unset means Google Chrome lets users control whether it's the default and, if not, whether user notifications should appear. Note: For Microsoft®Windows® administrators, turning this setting on only works for machines running Windows 7. For later versions, you must deploy a "default application associations" file that makes Google Chrome the handler for the https and http protocols (and, optionally, the ftp protocol and other file formats). See Chrome Help ( https://support.google.com/chrome?p=make_chrome_default_win ).

Configures the amount of memory that a single Google Chrome instance can use before tabs start being discarded (I.E. the memory used by the tab will be freed and the tab will have to be reloaded when switched to) to save memory. If the policy is set, browser will begin to discard tabs to save memory once the limitation is exceeded. However, there is no guarantee that the browser is always running under the limit. Any value under 1024 will be rounded up to 1024. If this policy is not set, the browser will only begin attempts to save memory once it has detected that the amount of physical memory on its machine is low.

Specify a target time window for the end of the relaunch notification period. Users are notified of the need for a browser relaunch or device restart based on the RelaunchNotification and RelaunchNotificationPeriod policy settings. Browsers and devices are forcibly restarted at the end of the notification period when the RelaunchNotification policy is set to 'Required'. This RelaunchWindow policy can be used to defer the end of the notification period so that it falls within a specific time window. If this policy is not set, the default target time window for Google ChromeOS is between 2 AM and 4 AM. The default target time window for Google Chrome is the whole day (i.e., the end of the notification period is never deferred). Note: Though the policy can accept multiple items in entries, all but the first item are ignored. Warning: Setting this policy may delay application of software updates. See https://chromeenterprise.google/policies/?policy=RelaunchWindow for more information about schema and formatting. Example value: { "entries": [ { "duration_mins": 240, "start": { "hour": 2, "minute": 15 } } ] }

Allows you to set the time period, in milliseconds, over which users are notified that Google Chrome must be relaunched or that a Google ChromeOS device must be restarted to apply a pending update. Over this time period, the user will be repeatedly informed of the need for an update. For Google ChromeOS devices, a restart notification appears in the system tray according to the RelaunchHeadsUpPeriod policy. For Google Chrome browsers, the app menu changes to indicate that a relaunch is needed once one third of the notification period passes. This notification changes color once two thirds of the notification period passes, and again once the full notification period has passed. The additional notifications enabled by the RelaunchNotification policy follow this same schedule. If not set, the default period of 604800000 milliseconds (one week) is used.

Configures the directory that Google Chrome will use for storing user data. If you set this policy, Google Chrome will use the provided directory regardless whether the user has specified the '--user-data-dir' flag or not. To avoid data loss or other unexpected errors this policy should not be set to a directory used for other purposes, because Google Chrome manages its contents. See https://support.google.com/chrome/a?p=Supported_directory_variables for a list of variables that can be used. If this policy is left not set the default profile path will be used and the user will be able to override it with the '--user-data-dir' command line flag. Example value: ${users}/${user_name}/Chrome

Setting the policy pre-configures up to 10 custom shortcuts on the Google Chrome New Tab page. If set, users will see these shortcuts by default, in addition to their personal shortcuts. Users can control visibility of their organization's shortcuts on the "Customize Chrome" panel. Shortcut URLs must be unique. If allow_user_edit is set to true, users can change the name of the shortcut. If set to false or unset, users cannot edit the name. If allow_user_delete is set to true, users can remove the shortcut. If set to false or unset, users cannot remove the shortcut. See https://chromeenterprise.google/policies/?policy=NTPShortcuts for more information about schema and formatting. Example value: [ { "name": "Google", "url": "https://www.google.com" }, { "name": "YouTube", "url": "https://www.youtube.com" }, { "name": "Google Drive", "url": "https://www.drive.google.com", "allow_user_edit": true, "allow_user_delete": true } ]

This policy controls the visibility of the Chrome history page organized into groups of pages. If the policy is set to Enabled, a Chrome history page organized into groups will be visible at chrome://history/grouped. If the policy is set to Disabled, a Chrome history page organized into groups will not be visible at chrome://history/grouped. If the policy is left unset, a Chrome history page organized into groups will be visible at chrome://history/grouped by default. Please note, if ComponentUpdatesEnabled policy is set to Disabled, but HistoryClustersVisible is set to Enabled or unset, a Chrome history page organized into groups will still be available at chrome://history/grouped, but may be less relevant to the user.

This policy controls whether or not the "Always open" checkbox is shown on external protocol launch confirmation prompts. If this policy is set to True or not set, when an external protocol confirmation is shown, the user can select "Always allow" to skip all future confirmation prompts for the protocol on this site. If this policy is set to False, the "Always allow" checkbox is not displayed and the user will be prompted each time an external protocol is invoked.

This policy controls the visibility of cards on the New Tab Page. Cards surface entry points to launch common user journeys based on the user's browsing behavior. If the policy is set to Enabled, the New Tab Page will show cards if content is available. If the policy is set to Disabled, the New Tab Page won't show cards. If the policy is not set, the user can control the card visibility. The default is visible.

This feature enables display of the full URL in the address bar. If this policy is set to True, then the full URL will be shown in the address bar, including schemes and subdomains. If this policy is set to False, then the default URL display will apply. If this policy is left unset, then the default URL display will apply and the user will be able to toggle between default and full URL display with a context menu option.

This policy controls the visibility of the Outlook Card on the New Tab Page. The card will only be displayed on the New Tab Page if the policy is enabled and your organization authorized the usage of the Outlook Calendar data in the browser. Outlook data will not be stored by the browser. The Outlook card shows the next calendar event, along with a glanceable look at the rest of the day's meetings. It aims to address the issue of context switching and enhance productivity by giving users a shortcut to their next meeting. The Microsoft Outlook card will require additional admin configuration. For detailed information on connecting the Chrome New Tab Page Card to Outlook, please see https://support.google.com/chrome/a?p=chrome_ntp_microsoft_cards. If the NTPCardsVisible is disabled, the Outlook Card will not be shown. If NTPCardsVisible is enabled, the Outlook card will be shown if this policy is also enabled and there is data to be shown. If NTPCardsVisible is unset, the Outlook card will be shown if this policy is also enabled, the user has the card enabled in Customize Chrome, and there is data to be shown.

This policy controls the visibility of the SharePoint and OneDrive File Card on the New Tab Page. The card will only be displayed on the New Tab Page if the policy is enabled and your organization authorized the usage of the SharePoint and OneDrive File data in the browser. SharePoint and OneDrive data will not be stored by the browser. The SharePoint and OneDrive Files recommendation card shows a list of recommended files. It aims to address the issue of context switching and enhance productivity by giving users a shortcut to their most important documents. The Microsoft SharePoint and OneDrive card will require additional admin configuration. For detailed information on connecting the Chrome New Tab Page Card to Sharepoint, please see https://support.google.com/chrome/a?p=chrome_ntp_microsoft_cards. If the NTPCardsVisible is disabled, the SharePoint and OneDrive Card will not be shown. If NTPCardsVisible is enabled, the SharePoint and OneDrive card will be shown if this policy is also enabled and there is data to be shown. If NTPCardsVisible is unset, the SharePoint and OneDrive card will be shown if this policy is also enabled, the user has the card enabled in Customize Chrome, and there is data to be shown.

Setting the policy to True displays the apps shortcut. Setting the policy to False means this shortcut never appears. If you set the policy, users can't change it. If not set, users decide to show or hide the apps shortcut from the bookmark bar context menu.

Google Chrome in-product surveys collect user feedback for the browser. Survey responses are not associated with user accounts. When this policy is Enabled or not set, in-product surveys may be shown to users. When this policy is Disabled, in-product surveys are not shown to users. This policy has no effect if MetricsReportingEnabled is set to Disabled, which disables in-product surveys as well.

Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context. Google Chrome will require cross-origin isolation when using SharedArrayBuffers from Google Chrome 91 onward (2021-05-25) for Web Compatibility reasons. Additional details can be found on: https://developer.chrome.com/blog/enabling-shared-array-buffer/. When set to Enabled, sites can use SharedArrayBuffer with no restrictions. When set to Disabled or not set, sites can only use SharedArrayBuffers when cross-origin isolated.

The URI template of the desired DNS-over-HTTPS resolver. To specify multiple DNS-over-HTTPS resolvers, separate the corresponding URI templates with spaces. If the DnsOverHttpsMode is set to "secure" then this policy must be set and not empty. On Google ChromeOS only, either this policy or the DnsOverHttpsTemplatesWithIdentifiers must be set, otherwise the DNS resolution will fail. If the DnsOverHttpsMode is set to "automatic" and this policy is set then the URI templates specified will be used; if this policy is unset then hardcoded mappings will be used to attempt to upgrade the user's current DNS resolver to a DoH resolver operated by the same provider. If the URI template contains a dns variable, requests to the resolver will use GET; otherwise requests will use POST. Incorrectly formatted templates will be ignored. Example value: https://dns.example.net/dns-query{?dns}

As described in https://www.chromestatus.com/feature/5148698084376576 , JavaScript modal dialogs, triggered by window.alert, window.confirm, and window.prompt, will be blocked in Google Chrome if triggered from a subframe whose origin is different from the main frame origin. This policy allows overriding that change. If the policy is set to enabled or unset, JavaScript dialogs triggered from a different origin subframe will be blocked. If the policy is set to disabled, JavaScript dialogs triggered from a different origin subframe will not be blocked. This policy will be removed from Google Chrome in the future.

This policy prevents the display of lookalike URL warnings on the sites listed. These warnings are typically shown on sites that Google Chrome believes might be trying to spoof another site the user is familiar with. If the policy is enabled and set to one or more domains, no lookalike warnings pages will be shown when the user visits pages on that domain. If the policy is not set, or set to an empty list, warnings may appear on any site the user visits. A hostname can be allowed with a complete host match, or any domain match. For example, a URL like "https://foo.example.com/bar" may have warnings suppressed if this list includes either "foo.example.com" or "example.com". Example value: foo.example.com example.org

Setting the policy to Enabled suppresses the warning that appears when Google Chrome is running on an unsupported computer or operating system. Setting the policy to Disabled or leaving it unset means the warnings appear on unsupported systems.

This policy allows the administrators to encrypt browser http cache on disk. When this policy is Enabled, browser cache will be encrypted. When this policy is Disabled or not set, browser cache will not be encrypted. Browser cache encryption may result in a performance impact.

This policy controls which software stack is used to communicate with the DNS server: the Operating System DNS client, or Google Chrome's built-in DNS client. This policy does not affect which DNS servers are used: if, for example, the operating system is configured to use an enterprise DNS server, that same server would be used by the built-in DNS client. It also does not control if DNS-over-HTTPS is used; Google Chrome will always use the built-in resolver for DNS-over-HTTPS requests. Please see the DnsOverHttpsMode policy for information on controlling DNS-over-HTTPS. If this policy is set to Enabled or is left unset, the built-in DNS client will be used. If this policy is set to Disabled, the built-in DNS client will only be used when DNS-over-HTTPS is in use.

Setting the policy to Enabled or leaving it unset turns on graphics acceleration, if available. Setting the policy to Disabled turns off graphics acceleration.

Controls whether the PDF viewer in Google Chrome uses an out-of-process iframe (OOPIF). This will be the new PDF viewer architecture in the future, as it is simpler and makes adding new features easier. The existing GuestView PDF viewer is an outdated, complex architecture that is being deprecated. When this policy is set to Enabled or not set, Google Chrome will be able to use the OOPIF PDF viewer architecture. Once Enabled or not set, the default behavior will be decided by Google Chrome. When this policy is set to Disabled, Google Chrome will strictly use the existing GuestView PDF viewer. It embeds a web page with a separate frame tree into another web page. This policy will be removed in the future, after the OOPIF PDF viewer feature has fully rolled out.

Controls whether the PDF viewer in Google Chrome uses Skia renderer. When this policy is enabled, the PDF viewer uses Skia renderer. When this policy is disabled, the PDF viewer uses its current AGG renderer. When this policy is not set, the PDF renderer will be chosen by the browser.

Enables the use of a default search provider on the context menu. If you set this policy to disabled the search context menu item that relies on your default search provider will not be available. If this policy is set to enabled or not set, the context menu item for your default search provider will be available. The policy value is only appled when the DefaultSearchProviderEnabled policy is enabled, and is not applicable otherwise.

This policy controls whether users can enable HTTPS-Only Mode (Always Use Secure Connections) in Settings. HTTPS-Only Mode upgrades all navigations to HTTPS. If this setting is not set or set to "allowed", users will be allowed to enable HTTPS-Only Mode. If this setting is set to "disallowed", HTTPS-Only Mode will be disabled. If this setting is set to "force_enabled", HTTPS-Only Mode will be enabled in Strict mode. If this setting is set to "force_balanced_enabled", HTTPS-Only Mode will be enabled in Balanced mode. "force_enabled" is supported from M112 onwards, "force_balanced_enabled" is supported from M129 onwards. "force_enabled" and "force_balanced_enabled" can be recommended to users too. HTTPS-Only Mode will be set Strict or Balanced initially but users are allowed to change it. If you set this policy to a value that is not supported by the version of Chrome that receives the policy, Chrome will default to the allowed setting. The separate HttpAllowlist policy can be used to exempt specific hostnames or hostname patterns from being upgraded to HTTPS by this feature. Example value: disallowed

If this policy is set false, domain reliability diagnostic data reporting is disabled and no data is sent to Google. If this policy is set true or not set, domain reliability diagnostic data reporting will follow the behavior of MetricsReportingEnabled for Google Chrome or DeviceMetricsReportingEnabled for Google ChromeOS.

Setting the policy to Enabled turns the internal PDF viewer off in Google Chrome, treats PDF files as a download, and lets users open PDFs with the default application. Setting the policy to Disabled means that unless users turns off the PDF plugin, it will open PDF files. If you set the policy, users can't change it in Google Chrome. If not set, users can choose whether to open PDF externally or not.

Setting the policy specifies the locale Google Chrome uses. Turning it off or leaving it unset means the locale will be the first valid locale from: 1) The user specified locale (if configured). 2) The system locale. 3) The fallback locale (en-US). Example value: en

Setting the policy to Enabled prevents webpage elements that aren't from the domain that's in the browser's address bar from setting cookies. Setting the policy to Disabled lets those elements set cookies and prevents users from changing this setting. Leaving it unset allows third-party cookies, but users can change this setting. Note: This policy doesn't apply in Incognito mode, where third-party cookies are blocked and can only be allowed at the site level. To allow cookies at the site level, use the CookiesAllowedForUrls policy.

Setting the policy to Enabled turns background mode on. In background mode, a Google Chrome process is started on OS sign-in and keeps running when the last browser window is closed, allowing background apps and the browsing session to remain active. The background process displays an icon in the system tray and can always be closed from there. Setting the policy to Disabled turns background mode off. If you set the policy, users can't change it in the browser settings. If unset, background mode is off at first, but users can change it.

Setting the policy to True or leaving it unset gives users control of Autofill for addresses in the UI. Setting the policy to False means Autofill never suggests or fills address information, nor does it save additional address information that users submit while browsing the web.

Setting the policy to True or leaving it unset means users can control autofill suggestions for credit cards in the UI. Setting the policy to False means autofill never suggests or fills credit card information, nor will it save additional credit card information that users might submit while browsing the web.

This policy enables or disables the Battery Saver Mode setting. On Chrome, this setting makes it so that frame rate is throttled to lower power consumption. If this policy is unset, the end user can control this setting in chrome://settings/performance. On ChromeOS, this setting makes it so that frame rate and CPU frequency are throttled, backlights are dimmed, and Android is put in Battery Saver Mode. On devices with multiple CPUs, some CPUs will be turned off. The different levels are: Disabled (0): Battery Saver Mode will be disabled. EnabledBelowThreshold (1): Battery Saver Mode will be enabled when the device is on battery power and battery level is low. EnabledOnBattery (2): This value is deprecated as of M121. From M121 onwards, values will be treated as EnabledBelowThreshold.

Setting the policy to True displays a bookmark bar in Google Chrome. Setting the policy to False means users never see the bookmark bar. If you set the policy, users can't change it. If not set, users decide whether to use this function.

This policy controls network prediction in Google Chrome. It controls DNS prefetching, TCP, and SSL preconnection and prerendering of webpages. If you set the policy, users can't change it. Leaving it unset turns on network prediction, but the user can change it.

Setting the policy to Enabled puts a Google web service in use to help resolve spelling errors. This policy only controls the use of the online service. Setting the policy to Disabled means this service is never used. Leaving the policy unset lets users choose whether to use the spellcheck service. The spell check can always use a downloaded dictionary locally unless the feature is disabled by SpellcheckEnabled in which case this policy will have no effect.

Enables origin-keyed process isolation for most pages (i.e., those assigned to an origin-keyed agent cluster by default). This improves security but also increases the number of processes created. Users are allowed to override the set policy value via the command-line flags or chrome://flags (both to turn this feature on or off). Setting the policy to Enabled results in most origins being isolated, even from other origins in the same site. See also the IsolateOrigins and SitePerProcess policies. Setting the policy to Disabled results in no origins being isolated from the rest of their site unless an origin explicitly asks to. Not setting the policy results in the browser determining which origins to isolate and when to isolate them.

When this policy is Enabled, anonymous reporting of usage and crash-related data about Google Chrome to Google is recommended to be enabled by default. Users will still be able to change this setting. When this policy is Disabled, anonymous reporting is disabled and no usage or crash data is sent to Google. Users won't be able to change this setting. When this policy is not set, users can choose the anonymous reporting behavior at installation or first run, and can change this setting later. (For Google ChromeOS, see DeviceMetricsReportingEnabled.) On Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core. On macOS, this policy is only available on instances that are managed via MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.

Setting the policy to True turns on search suggestions in Google Chrome's address bar. Setting the policy to False turns off these search suggestions. Suggestions based on bookmarks or history are unaffected by the policy. If you set the policy, users can't change it. If not set, search suggestions are on at first, but users can turn them off any time.

Setting the policy to True provides translation functionality when it's appropriate for users by showing an integrated translate toolbar in Google Chrome and a translate option on the right-click context menu. Setting the policy to False shuts off all built-in translate features. If you set the policy, users can't change this function. Leaving it unset lets them change the setting.

Setting the policy to Enabled imports autofill form data from the previous default browser on first run. Setting the policy to Disabled or leaving it unset means no autofill form data is imported on first run. Users can trigger an import dialog and the autofill form data checkbox will be checked or unchecked to match this policy's value.

Setting the policy to Enabled imports bookmarks from the previous default browser on first run. Setting the policy to Disabled or leaving it unset means no bookmarks are imported on first run. Users can trigger an import dialog and the bookmarks checkbox will be checked or unchecked to match this policy's value.

Setting the policy to Enabled imports browsing history from the previous default browser on first run. Setting the policy to Disabled or leaving it unset means no browsing history is imported on first run. Users can trigger an import dialog and the browsing history checkbox will be checked or unchecked to match this policy's value.

This policy controls only the first run import behavior after installation. It enables more seamless transition to Google Chrome in environments where a different browser was extensively used prior to installing the browser. This policy does not affect password manager capabilities for Google accounts. Setting the policy to Enabled imports saved passwords from the previous default browser on first run and manual importing from the settings page is also possible. Setting the policy to Disabled means no saved passwords are imported on first run and manual importing from the Settings page is blocked. Leaving the policy unset means no saved passwords are imported on first run but the user can choose to do that from the settings page.

Setting the policy to Enabled imports the default search engine from the previous default browser on first run. Setting the policy to Disabled or leaving it unset means the default search engine isn't imported on first run. Users can trigger an import dialog and the default search engine checkbox will be checked or unchecked to match this policy's value.

If this policy is Enabled, the option to keep any existing browsing data when creating an enterprise profile will be checked by default. If this policy is unset or Disabled, the option to keep any existing browsing data when creating an enterprise profile will not be checked by default. Regardless of the value, the user will be able to decide whether or not to keep any existing browsing data when creating an enterprise profile. This policy has no effect if the option to keep existing browsing data is not available; this happens if enterprise profile separation is strictly enforced, or if the data would be from an already managed profile.

Setting the policy changes the default directory that Chrome downloads files to, but users can change the directory. Leaving the policy unset means Chrome uses its platform-specific default directory. This policy has no effect if the policy DownloadDirectory is set. Note: See a list of variables you can use ( https://www.chromium.org/administrators/policy-list-3/user-data-directory-variables ). Example value: /home/${user_name}/Downloads

Setting the policy sets up the directory Chrome uses for downloading files. It uses the provided directory, whether or not users specify one or turned on the flag to be prompted for download location every time. This policy overrides the DefaultDownloadDirectory policy. Leaving the policy unset means Chrome uses the default download directory, and users can change it. On Google ChromeOS it's possible to set it only to Google Drive directories. Note: See a list of variables you can use ( https://www.chromium.org/administrators/policy-list-3/user-data-directory-variables ). Example value: /home/${user_name}/Downloads

This feature enables display of the full URL in the address bar. If this policy is set to True, then the full URL will be shown in the address bar, including schemes and subdomains. If this policy is set to False, then the default URL display will apply. If this policy is left unset, then the default URL display will apply and the user will be able to toggle between default and full URL display with a context menu option.

Enable the Live Caption feature. If this policy is set to Enabled, Live Caption will always be turned on. If this policy is set to Disabled, Live Caption will always be turned off. If you set this policy as mandatory, users cannot change or override it. If this policy is left unset, Live Caption is disabled initially but can be enabled by the user anytime.

Enable translation of live captions. Captions will be sent to Google for translation. If this policy is set to Enabled, Live Translate will always be turned on. If this policy is set to Disabled, Live Translate will always be turned off. If you set this policy as mandatory, users cannot change or override it. If this policy is left unset, Live Translate is disabled initially but can be enabled by the user anytime. In LiveCaptionEnabled is set to Disabled, Live Translate will be disabled regardless of this policy setting.

If DefaultSearchProviderEnabled is on, setting DefaultSearchProviderEncodings specifies the character encodings supported by the search provider. Encodings are code page names such as UTF-8, GB2312, and ISO-8859-1. They're tried in the order provided. Leaving DefaultSearchProviderEncodings unset puts UTF-8 in use. Example value: UTF-8 UTF-16 GB2312 ISO-8859-1

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderKeyword specifies the keyword or shortcut used in the address bar to trigger the search for this provider. Leaving DefaultSearchProviderKeyword unset means no keyword activates the search provider. Example value: mis

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderName specifies the default search provider's name. Leaving DefaultSearchProviderName unset means the hostname specified by the search URL is used. Example value: My Intranet Search

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderNewTabURL specifies the URL of the search engine used to provide a New Tab page. Leaving DefaultSearchProviderNewTabURL unset means no new tab page is provided. Example value: https://search.my.company/newtab

Setting the policy to Enabled means a default search is performed when a user enters non-URL text in the address bar. To specify the default search provider, set the rest of the default search policies. If you leave those policies empty, the user can choose the default provider. Setting the policy to Disabled means there's no search when the user enters non-URL text in the address bar. The Disabled value is not supported by the Google Admin console. If you set the policy, users can't change it in Google Chrome. If not set, the default search provider is on, and users can set the search provider list. On Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core. On macOS, this policy is only available on instances that are managed via MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderAlternateURLs specifies a list of alternate URLs for extracting search terms from the search engine. The URLs should include the string '{searchTerms}'. Leaving DefaultSearchProviderAlternateURLs unset means no alternate URLs are used to extract search terms. Example value: https://search.my.company/suggest#q={searchTerms} https://search.my.company/suggest/search#q={searchTerms}

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderImageURL specifies the URL of the search engine used for image search. (If DefaultSearchProviderImageURLPostParams is set, then image search requests use the POST method instead.) Leaving DefaultSearchProviderImageURL unset means no image search is used. If image search uses the GET method, then the URL must specify image parameters using a valid combination of the following placeholders: '{google:imageURL}', '{google:imageOriginalHeight}', '{google:imageOriginalWidth}', '{google:processedImageDimensions}', '{google:imageSearchSource}', '{google:imageThumbnail}', '{google:imageThumbnailBase64}'. Example value: https://search.my.company/searchbyimage/upload

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderImageURLPostParams specifies the parameters during image search with POST. It consists of comma-separated, name-value pairs. If a value is a template parameter, such as {imageThumbnail}, real image thumbnail data replaces it. Leaving DefaultSearchProviderImageURLPostParams unset means image search request is sent using the GET method. The URL must specify the image parameter using a valid combination of the following placeholders depending on what the search provider supports: '{google:imageURL}', '{google:imageOriginalHeight}', '{google:imageOriginalWidth}', '{google:processedImageDimensions}', '{google:imageSearchSource}', '{google:imageThumbnail}', '{google:imageThumbnailBase64}'. Example value: content={google:imageThumbnail},url={google:imageURL},sbisrc={google:imageSearchSource}

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderSearchURLPostParams specifies the parameters when searching a URL with POST. It consists of comma-separated, name-value pairs. If a value is a template parameter, such as '{searchTerms}', real search terms data replaces it. Leaving DefaultSearchProviderSearchURLPostParams unset means search requests are sent using the GET method. Example value: q={searchTerms},ie=utf-8,oe=utf-8

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderSuggestURLPostParams specifies the parameters during suggestion search with POST. It consists of comma-separated, name-value pairs. If a value is a template parameter, such as '{searchTerms}', real search terms data replaces it. Leaving DefaultSearchProviderSuggestURLPostParams unset unset means suggest search requests are sent using the GET method. Example value: q={searchTerms},ie=utf-8,oe=utf-8

This policy controls the browser's ability to automatically remember passwords on websites and save them in the built-in password manager. It does not limit access or change the contents of passwords saved in the password manager and possibly synchronized to the Google account profile and Android. Setting the policy to Enabled means users have Google Chrome remember passwords and provide them the next time they sign in to a site. Setting the policy to Disabled means users can't save new passwords, but previously saved passwords will still work. If the policy is set, users can't change it in Google Chrome. If not set, the user can turn off password saving.

Setting the policy to Enabled turns headers and footers on in print preview. Setting the policy to Disabled turns them off in print preview. If you set the policy, users can't change it. If unset, users decides whether headers and footers appear.

Setting the policy to Enabled means Google Chrome uses the OS default printer as the default destination for print preview. Setting the policy to Disabled or leaving it unset means Google Chrome uses the most recently used printer as the default destination for print preview.

Allows you to control whether Google Chrome's Safe Browsing feature is enabled and the mode it operates in. If this policy is set to 'NoProtection' (value 0), Safe Browsing is never active. If this policy is set to 'StandardProtection' (value 1, which is the default), Safe Browsing is always active in the standard mode. If this policy is set to 'EnhancedProtection' (value 2), Safe Browsing is always active in the enhanced mode, which provides better security, but requires sharing more browsing information with Google. If you set this policy as mandatory, users cannot change or override the Safe Browsing setting in Google Chrome. If this policy is left not set, Safe Browsing will operate in Standard Protection mode but users can change this setting. See https://support.google.com/chrome?p=safe_browsing_preferences for more info on Safe Browsing.

Setting the policy lets you specify system behavior on startup. Turning this setting off amounts to leaving it unset as Google Chrome must have specified start up behavior. If you set the policy, users can't change it in Google Chrome. If not set, users can change it. Setting this policy to RestoreOnStartupIsLastSession or RestoreOnStartupIsLastSessionAndURLs turns off some settings that rely on sessions or that perform actions on exit, such as clearing browsing data on exit or session-only cookies. If this policy is set to RestoreOnStartupIsLastSessionAndURLs, browser will restore previous session and open a separate window to show URLs that are set from RestoreOnStartupURLs. Note that users can choose to keep those URLs open and they will also be restored in the future session. On Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core. On macOS, this policy is only available on instances that are managed via MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.

Setting the policy sets the default homepage URL in Google Chrome. You open the homepage using the Home button. On desktop, the RestoreOnStartup policies control the pages that open on startup. If the homepage is set to the New Tab Page, by the user or HomepageIsNewTabPage, this policy has no effect. The URL needs a standard scheme, such as http://example.com or https://example.com. When this policy is set, users can't change their homepage URL in Google Chrome. Leaving both HomepageLocation and HomepageIsNewTabPage unset lets users choose their homepage. On Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core. On macOS, this policy is only available on instances that are managed via MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core. Example value: https://www.chromium.org

Setting the policy to Enabled shows the Home button on Google Chrome's toolbar. Setting the policy to Disabled keeps the Home button from appearing. If you set the policy, users can't change it in Google Chrome. If not set, users chooses whether to show the Home button.

If RestoreOnStartup is set to RestoreOnStartupIsURLs, then setting RestoreOnStartupURLs to a list of URLs specify which URLs open. If not set, the New Tab page opens on start up. On Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core. On macOS, this policy is only available on instances that are managed via MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core. Example value: https://example.com https://www.chromium.org

Setting the policy to Enabled makes the New Tab page the user's homepage, ignoring any homepage URL location. Setting the policy to Disabled means that their homepage is never the New Tab page, unless the user's homepage URL is set to chrome://newtab. If you set the policy, users can't change their homepage type in Google Chrome. If not set, the user decides whether or not the New Tab page is their homepage. On Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core. On macOS, this policy is only available on instances that are managed via MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core.

Enable the Live Caption feature. If this policy is set to Enabled, Live Caption will always be turned on. If this policy is set to Disabled, Live Caption will always be turned off. If you set this policy as mandatory, users cannot change or override it. If this policy is left unset, Live Caption is disabled initially but can be enabled by the user anytime.

Enable translation of live captions. Captions will be sent to Google for translation. If this policy is set to Enabled, Live Translate will always be turned on. If this policy is set to Disabled, Live Translate will always be turned off. If you set this policy as mandatory, users cannot change or override it. If this policy is left unset, Live Translate is disabled initially but can be enabled by the user anytime. In LiveCaptionEnabled is set to Disabled, Live Translate will be disabled regardless of this policy setting.

Setting the policy lets you set a list of URL patterns that can use Desktop, Window, and Tab Capture. Leaving the policy unset means that sites will not be considered for an override at this level of Capture. This policy is not considered if a site matches a URL pattern in any of the following policies: WindowCaptureAllowedByOrigins, TabCaptureAllowedByOrigins, SameOriginTabCaptureAllowedByOrigins. If a site matches a URL pattern in this policy, the ScreenCaptureAllowed will not be considered. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns/. This policy only matches based on origin, so any path in the URL pattern is ignored. Example value: https://www.example.com [*.]example.edu

If enabled or not configured (default), a Web page can use screen-share APIs (e.g., getDisplayMedia() or the Desktop Capture extension API) to prompt the user to select a tab, window or desktop to capture. When this policy is disabled, any calls to screen-share APIs will fail with an error; however this policy is not considered (and a site will be allowed to use screen-share APIs) if the site matches an origin pattern in any of the following policies: ScreenCaptureAllowedByOrigins, WindowCaptureAllowedByOrigins, TabCaptureAllowedByOrigins, SameOriginTabCaptureAllowedByOrigins.

Setting the policy lets you set a list of URL patterns that can capture tabs with their same Origin. Leaving the policy unset means that sites will not be considered for an override at this level of capture. Note that windowed Chrome Apps with the same origin as this site will still be allowed to be captured. If a site matches a URL pattern in this policy, the following policies will not be considered: TabCaptureAllowedByOrigins, WindowCaptureAllowedByOrigins, ScreenCaptureAllowedByOrigins, ScreenCaptureAllowed. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns/. This policy only matches based on origin, so any path in the URL pattern is ignored. Example value: https://www.example.com [*.]example.edu

Setting the policy lets you set a list of URL patterns that can use Tab Capture. Leaving the policy unset means that sites will not be considered for an override at this level of capture. Note that windowed Chrome Apps will still be allowed to be captured. This policy is not considered if a site matches a URL pattern in the SameOriginTabCaptureAllowedByOrigins policy. If a site matches a URL pattern in this policy, the following policies will not be considered: WindowCaptureAllowedByOrigins, ScreenCaptureAllowedByOrigins, ScreenCaptureAllowed. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns/. This policy only matches based on origin, so any path in the URL pattern is ignored. Example value: https://www.example.com [*.]example.edu

Setting the policy lets you set a list of URL patterns that can use Window and Tab Capture. Leaving the policy unset means that sites will not be considered for an override at this level of Capture. This policy is not considered if a site matches a URL pattern in any of the following policies: TabCaptureAllowedByOrigins, SameOriginTabCaptureAllowedByOrigins. If a site matches a URL pattern in this policy, the following policies will not be considered: ScreenCaptureAllowedByOrigins, ScreenCaptureAllowed. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns/. This policy only matches based on origin, so any path in the URL pattern is ignored. Example value: https://www.example.com [*.]example.edu

Setting the policy to All (0) or leaving it unset lets users edit trust settings for all CA certificates, remove user-imported certificates, and import certificates using Certificate Manager. Setting the policy to UserOnly (1) lets users manage only user-imported certificates, but not change trust settings of built-in certificates. Setting it to None (2) lets users view (not manage) CA certificates.

If enabled(or not set), user-added TLS certificates from platform trust stores will be used in path-building for TLS server authentication. If disabled, user-added TLS certificates from platform trust stores will not be used in path-building for TLS server authentication.

Setting the policy lets you set a list of URL patterns that specify the sites that can access sensors like motion and light sensors. Leaving the policy unset means DefaultSensorsSetting applies for all sites, if it's set. If not, the user's personal setting applies. If the same URL pattern exists in both this policy and the SensorsBlockedForUrls policy, the latter is prioritized and access to motion or light sensors will be blocked. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Example value: https://www.example.com [*.]example.edu

Allows you to set a list of URL patterns that specify sites which are allowed to download multiple files automatically. For detailed information on valid URL patterns, please see https://chromeenterprise.google/policies/url-patterns. If a URL matches both AutomaticDownloadsAllowedForUrls and AutomaticDownloadsBlockedForUrls, AutomaticDownloadsBlockedForUrls takes precedence. If this policy is not set, DefaultAutomaticDownloadsSetting applies for all sites, if it is set. If not, the user's personal setting applies. Example value: https://www.example.com [*.]example.edu

Setting the policy lets you set a list of URL patterns that specify sites that can use the clipboard site permission. This does not include all clipboard operations on origins matching the patterns. For instance, users will still be able to paste using keyboard shortcuts as this isn't gated by the clipboard site permission. Leaving the policy unset means DefaultClipboardSetting applies for all sites, if it's set. If not, the user's personal setting applies. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Example value: https://www.example.com [*.]example.edu

Allows you to set a list of url patterns that specify sites which are allowed to set cookies. URL patterns may be a single URL indicating that the site may use cookies on all top-level sites. Patterns may also be two URLs delimited by a comma. The first specifies the site that should be allowed to use cookies. The second specifies the top-level site that the first value should be applied on. If you use a pair of URLs, the first value in the pair supports * but the second value does not. Using * for the first value indicates that all sites may use cookies when the second URL is the top-level site. If this policy is left not set the global default value will be used for all sites either from the DefaultCookiesSetting or BlockThirdPartyCookies policies if they are set, or the user's personal configuration otherwise. See also policies CookiesBlockedForUrls and CookiesSessionOnlyForUrls. Note that there must be no conflicting URL patterns between these three policies - it is unspecified which policy takes precedence. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. * is not an accepted value for this policy. Example value: https://www.example.com [*.]example.edu https://www.example.com/,https://www.toplevel.com/ *,https://www.toplevel.com/

Allows you to set a list of URL patterns that specify the sites that are allowed to use the Idle Detection API witout asking the user. Blocklist entries have higher priority than allowlist entries, which in turn have higher priority than the configured default value. For detailed information on valid site url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. This policy only matches based on origin, so any path in the URL pattern is ignored. If this policy is not set, the global default value will be used for all sites, which is configured by the DefaultIdleDetectionSetting (Default idle detection setting) policy, if set, or by the user's personal configuration otherwise. Example value: https://www.example.com [*.]example.edu

Setting the policy lets you set a list of URL patterns that specify sites that may display images. Leaving the policy unset means DefaultImagesSetting applies for all sites, if it's set. If not, the user's personal setting applies. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Note that previously this policy was erroneously enabled on Android, but this functionality has never been fully supported on Android. Example value: https://www.example.com [*.]example.edu

Allows you to set a list of url patterns that specify sites which are allowed to display blockable (i.e. active) mixed content (i.e. HTTP content on HTTPS sites) and for which optionally blockable mixed content upgrades will be disabled. If this policy is left not set blockable mixed content will be blocked and optionally blockable mixed content will be upgraded, and users will be allowed to set exceptions to allow it for specific sites. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Example value: https://www.example.com [*.]example.edu

Setting the policy lets you set a list of URL patterns that specify the sites that can run JavaScript. Leaving the policy unset means DefaultJavaScriptSetting applies for all sites, if it's set. If not, the user's personal setting applies. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Example value: https://www.example.com [*.]example.edu

Allows you to set a list of site url patterns that specify sites for which advanced JavaScript optimizations are enabled. For detailed information on valid site url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. JavaScript optimization policy exceptions will only be enforced at a site granularity (eTLD+1). A policy set for only subdomain.site.com will not correctly apply to site.com or subdomain.site.com since they both resolve to the same eTLD+1 (site.com) for which there is no policy. In this case, policy must be set on site.com to apply correctly for both site.com and subdomain.site.com. This policy applies on a frame-by-frame basis and not based on top level origin url alone, so e.g. if site-one.com is listed in the JavaScriptOptimizerAllowedForSites policy but site-one.com loads a frame containing site-two.com then site-one.com will have JavaScript optimizations enabled, but site-two.com will use the policy from DefaultJavaScriptOptimizerSetting, if set, or default to JavaScript optimizations enabled. Blocklist entries have higher priority than allowlist entries, which in turn have higher priority than the configured default value. If this policy is not set for a site then the policy from DefaultJavaScriptOptimizerSetting applies to the site, if set, otherwise Javascript optimization is enabled for the site. Example value: [*.]example.edu

Allows you to set a list of site url patterns that specify sites which are allowed to run JavaScript with JIT (Just In Time) compiler enabled. For detailed information on valid site url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. JavaScript JIT policy exceptions will only be enforced at a site granularity (eTLD+1). A policy set for only subdomain.site.com will not correctly apply to site.com or subdomain.site.com since they both resolve to the same eTLD+1 (site.com) for which there is no policy. In this case, policy must be set on site.com to apply correctly for both site.com and subdomain.site.com. This policy applies on a frame-by-frame basis and not based on top level origin url alone, so e.g. if site-one.com is listed in the JavaScriptJitAllowedForSites policy but site-one.com loads a frame containing site-two.com then site-one.com will have JavaScript JIT enabled, but site-two.com will use the policy from DefaultJavaScriptJitSetting, if set, or default to JavaScript JIT enabled. If this policy is not set for a site then the policy from DefaultJavaScriptJitSetting applies to the site, if set, otherwise Javascript JIT is enabled for the site. Example value: [*.]example.edu

Setting this policy allows the domains listed to access file:// URLs in the PDF Viewer. Adding to the policy allows the domain to access file:// URLs in the PDF Viewer. Removing from the policy disallows the domain from accessing file:// URLs in the PDF Viewer. Leaving the policy unset disallows all domains from accessing file:// URLs in the PDF Viewer. Example value: example.com google.com

Sets a list of site url patterns that specify sites which will automatically grant the local fonts permission. This will extend the ability of sites to see information about local fonts. For detailed information on valid site url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. This policy only matches based on origin, so any path in the URL pattern is ignored. If this policy is not set for a site then the policy from DefaultLocalFontsSetting applies to the site, if set, otherwise the permission will follow the browser's defaults and allow users to choose this permission per site. Example value: https://www.example.com [*.]example.edu

Setting the policy lets you set a list of URL patterns that specify the sites that can display notifications. Leaving the policy unset means DefaultNotificationsSetting applies for all sites, if it's set. If not, the user's personal setting applies. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Example value: https://www.example.com [*.]example.edu

Setting the policy lets you set a list of URL patterns that specify the sites that can open pop-ups. Leaving the policy unset means DefaultPopupsSetting applies for all sites, if it's set. If not, the user's personal setting applies. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Example value: https://www.example.com [*.]example.edu

Setting the policy lets you set a list of URL patterns that specify sites that are allowed to access the user's high accuracy geolocation without first having to request the user's permission to do so. Leaving the policy unset means DefaultGeolocationSetting applies for all sites, if it's set. If not, the user's personal setting applies. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Example value: https://www.example.com [*.]example.edu

Setting the policy lets you list the URL patterns that specify which sites can ask users to grant them read access to files or directories in the host operating system's file system via the File System API. Leaving the policy unset means DefaultFileSystemReadGuardSetting applies for all sites, if it's set. If not, users' personal settings apply. URL patterns must not conflict with FileSystemReadBlockedForUrls. Neither policy takes precedence if a URL matches with both. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. * is not an accepted value for this policy. Example value: https://www.example.com [*.]example.edu

Setting the policy lets you list the URL patterns that specify which sites can ask users to grant them access to a serial port. Leaving the policy unset means DefaultSerialGuardSetting applies for all sites, if it's set. If not, users' personal settings apply. For URL patterns which do not match the policy SerialBlockedForUrls (if there is a match), DefaultSerialGuardSetting (if set), or the users' personal settings take precedence, in that order. If URL patterns conflict with SerialBlockedForUrls they will be ignored. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. * is not an accepted value for this policy. Example value: https://www.example.com [*.]example.edu

Setting the policy lets you list the URL patterns that specify which sites can ask users to grant them access to a HID device. Leaving the policy unset means DefaultWebHidGuardSetting applies for all sites, if it's set. If not, users' personal settings apply. For URL patterns which do not match the policy, the following take precedence, in this order: * WebHidBlockedForUrls (if there is a match), * DefaultWebHidGuardSetting (if set), or * Users' personal settings. URL patterns must not conflict with WebHidBlockedForUrls. Neither policy takes precedence if a URL matches with both. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. * is not an accepted value for this policy. Example value: https://google.com https://chromium.org

Setting the policy lets you list the URL patterns that specify which sites can ask users to grant them access to a USB device. Leaving the policy unset means DefaultWebUsbGuardSetting applies for all sites, if it's set. If not, users' personal settings apply. URL patterns must not conflict with WebUsbAskForUrls. Neither policy takes precedence if a URL matches with both. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. * is not an accepted value for this policy. Example value: https://www.example.com [*.]example.edu

Allows you to set a list of site url patterns that specify sites which will automatically grant the window management permission. This will extend the ability of sites to see information about the device's screens and use that information to open and place windows or request fullscreen on specific screens. For detailed information on valid site url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. This policy only matches based on origin, so any path in the URL pattern is ignored. If this policy is not set for a site then the policy from DefaultWindowManagementSetting applies to the site, if set, otherwise the permission will follow the browser's defaults and allow users to choose this permission per site. This replaces the deprecated WindowPlacementAllowedForUrls policy. Example value: https://www.example.com [*.]example.edu

Setting the policy lets you list the URL patterns that specify which sites can ask users to grant them write access to files or directories in the host operating system's file system. Leaving the policy unset means DefaultFileSystemWriteGuardSetting applies for all sites, if it's set. If not, users' personal settings apply. URL patterns must not conflict with FileSystemWriteBlockedForUrls. Neither policy takes precedence if a URL matches with both. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. * is not an accepted value for this policy. Example value: https://www.example.com [*.]example.edu

Setting the policy lets you list the URLs that specify which sites are automatically granted permission to access a HID device containing a top-level collection with the given HID usage. Each item in the list requires both usages and urls fields for the policy to be valid. Each item in the usages field must have a usage_page and may have a usage field. Omitting the usage field will create a policy matching any device containing a top-level collection with a usage from the specified usage page. An item which has a usage field without a usage_page field is invalid and is ignored. Leaving the policy unset means DefaultWebHidGuardSetting applies, if it's set. If not, the user's personal setting applies. URLs in this policy shouldn't conflict with those configured through WebHidBlockedForUrls. If they do, this policy takes precedence over WebHidBlockedForUrls. See https://chromeenterprise.google/policies/?policy=WebHidAllowDevicesWithHidUsagesForUrls for more information about schema and formatting. Example value: [ { "urls": [ "https://google.com", "https://chromium.org" ], "usages": [ { "usage": 5678, "usage_page": 1234 } ] } ]

Setting the policy lets you list the URLs that specify which sites are automatically granted permission to access a HID device with the given vendor and product IDs. Each item in the list requires both devices and urls fields for the item to be valid, otherwise the item is ignored. Each item in the devices field must have a vendor_id and may have a product_id field. Omitting the product_id field will create a policy matching any device with the specified vendor ID. An item which has a product_id field without a vendor_id field is invalid and is ignored. Leaving the policy unset means DefaultWebHidGuardSetting applies, if it's set. If not, the user's personal setting applies. URLs in this policy shouldn't conflict with those configured through WebHidBlockedForUrls. If they do, this policy takes precedence over WebHidBlockedForUrls. See https://chromeenterprise.google/policies/?policy=WebHidAllowDevicesForUrls for more information about schema and formatting. Example value: [ { "devices": [ { "product_id": 5678, "vendor_id": 1234 } ], "urls": [ "https://google.com", "https://chromium.org" ] } ]

Setting the policy lets you make a list of URL patterns that specify sites for which Chrome can automatically select a client certificate. The value is an array of stringified JSON dictionaries, each with the form { "pattern": "$URL_PATTERN", "filter" : $FILTER }, where $URL_PATTERN is a content setting pattern. $FILTER restricts the client certificates the browser automatically selects from. Independent of the filter, only certificates that match the server's certificate request are selected. On Android and iOS, Chrome can only select client certificates that it has provisioned itself; it cannot access certificates installed at the operating system level. Examples for the usage of the $FILTER section: * When $FILTER is set to { "ISSUER": { "CN": "$ISSUER_CN" } }, only client certificates issued by a certificate with the CommonName $ISSUER_CN are selected. * When $FILTER contains both the "ISSUER" and the "SUBJECT" sections, only client certificates that satisfy both conditions are selected. * When $FILTER contains a "SUBJECT" section with the "O" value, a certificate needs at least one organization matching the specified value to be selected. * When $FILTER contains a "SUBJECT" section with a "OU" value, a certificate needs at least one organizational unit matching the specified value to be selected. * When $FILTER is set to {}, the selection of client certificates is not additionally restricted. Note that filters provided by the web server still apply. Leaving the policy unset means there's no autoselection for any site. See https://chromeenterprise.google/policies/?policy=AutoSelectCertificateForUrls for more information about schema and formatting. Example value: {"pattern":"https://www.example.com","filter":{"ISSUER":{"CN":"certificate issuer name", "L": "certificate issuer location", "O": "certificate issuer org", "OU": "certificate issuer org unit"}, "SUBJECT":{"CN":"certificate subject name", "L": "certificate subject location", "O": "certificate subject org", "OU": "certificate subject org unit"}}}

Setting the policy lets you set a list of URL patterns that specify the sites that can't access sensors like motion and light sensors. Leaving the policy unset means DefaultSensorsSetting applies for all sites, if it's set. If not, the user's personal setting applies. If the same URL pattern exists in both this policy and the SensorsAllowedForUrls policy, this policy is prioritized and access to motion or light sensors will be blocked. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Example value: https://www.example.com [*.]example.edu

Allows you to set a list of URL patterns that specify sites which are not allowed to download multiple files automatically. For detailed information on valid URL patterns, please see https://chromeenterprise.google/policies/url-patterns. If a URL matches both AutomaticDownloadsAllowedForUrls and AutomaticDownloadsBlockedForUrls, AutomaticDownloadsBlockedForUrls takes precedence. If this policy is not set, DefaultAutomaticDownloadsSetting applies for all sites, if it is set. If not, the user's personal setting applies. Example value: https://www.example.com [*.]example.edu

Setting the policy lets you set a list of URL patterns that specify sites that can't use the clipboard site permission. This does not include all clipboard operations on origins matching the patterns. For instance, users will still be able to paste using keyboard shortcuts as this isn't gated by the clipboard site permission. Leaving the policy unset means DefaultClipboardSetting applies for all sites, if it's set. If not, the user's personal setting applies. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Example value: https://www.example.com [*.]example.edu

Setting the policy lets you make a list of URL patterns that specify sites that can't set cookies. Leaving the policy unset results in the use of DefaultCookiesSetting for all sites, if it's set. If not, the user's personal setting applies. While no specific policy takes precedence, see CookiesAllowedForUrls and CookiesSessionOnlyForUrls. URL patterns among these 3 policies must not conflict. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. * is not an accepted value for this policy. Example value: https://www.example.com [*.]example.edu

Setting the policy lets you set a list of URL patterns that specify sites that are not allowed to access the user's geolocation, and are also prevented from requesting user permission to do so. Leaving the policy unset means DefaultGeolocationSetting applies for all sites, if it's set. If not, the user's personal setting applies. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Example value: https://www.example.com [*.]example.edu

Allows you to set a list of URL patterns that specify the sites that are not allowed to use the Idle Detection API. For detailed information on valid site url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. This policy only matches based on origin, so any path in the URL pattern is ignored. If this policy is not set, the global default value will be used for all sites, which is configured by the DefaultIdleDetectionSetting (Default idle detection setting) policy, if set, or by the user's personal configuration otherwise. Example value: https://www.example.com [*.]example.edu

Setting the policy lets you set a list of URL patterns that specify sites that can't display images. Leaving the policy unset means DefaultImagesSetting applies for all sites, if it's set. If not, the user's personal setting applies. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Note that previously this policy was erroneously enabled on Android, but this functionality has never been fully supported on Android. Example value: https://www.example.com [*.]example.edu

Allows you to set a list of url patterns that specify sites which are not allowed to display blockable (i.e. active) mixed content (i.e. HTTP content on HTTPS sites), and for which optionally blockable (i.e. passive) mixed content will be upgraded. If this policy is left not set blockable mixed content will be blocked and optionally blockable mixed content will be upgraded, but users will be allowed to set exceptions to allow it for specific sites. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Example value: https://www.example.com [*.]example.edu

Allows you to set a list of site url patterns that specify sites which are not allowed to run JavaScript JIT (Just In Time) compiler enabled. Disabling the JavaScript JIT will mean that Google Chrome may render web content more slowly, and may also disable parts of JavaScript including WebAssembly. Disabling the JavaScript JIT may allow Google Chrome to render web content in a more secure configuration. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. JavaScript JIT policy exceptions will only be enforced at a site granularity (eTLD+1). A policy set for only subdomain.site.com will not correctly apply to site.com or subdomain.site.com since they both resolve to the same eTLD+1 (site.com) for which there is no policy. In this case, policy must be set on site.com to apply correctly for both site.com and subdomain.site.com. This policy applies on a frame-by-frame basis and not based on top level origin url alone, so e.g. if site-one.com is listed in the JavaScriptJitBlockedForSites policy but site-one.com loads a frame containing site-two.com then site-one.com will have JavaScript JIT disabled, but site-two.com will use the policy from DefaultJavaScriptJitSetting, if set, or default to JavaScript JIT enabled. If this policy is not set for a site then the policy from DefaultJavaScriptJitSetting applies to the site, if set, otherwise JavaScript JIT is enabled for the site. Example value: [*.]example.edu

Setting the policy lets you set a list of URL patterns that specify the sites that can't run JavaScript. Leaving the policy unset means DefaultJavaScriptSetting applies for all sites, if it's set. If not, the user's personal setting applies. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Note that this policy blocks JavaScript based on whether the origin of the top-level document (usually the page URL that is also displayed in the address bar) matches any of the patterns. Therefore this policy is not appropriate for mitigating web supply-chain attacks. For example, supplying the pattern "https://[*.]foo.com/" will not prevent a page hosted on, say, https://example.com from running a script loaded from https://www.foo.com/example.js. Furthermore, supplying the pattern "https://example.com/" will not prevent a document from https://example.com from running scripts if it is not the top-level document, but embedded as a sub-frame into a page hosted on another origin, say, https://www.bar.com. Example value: https://www.example.com [*.]example.edu

Allows you to set a list of site url patterns that specify sites for which advanced JavaScript optimizations are disabled. Disabling JavaScript optimizations will mean that Google Chrome may render web content more slowly. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. JavaScript optimization policy exceptions will only be enforced at a site granularity (eTLD+1). A policy set for only subdomain.site.com will not correctly apply to site.com or subdomain.site.com since they both resolve to the same eTLD+1 (site.com) for which there is no policy. In this case, policy must be set on site.com to apply correctly for both site.com and subdomain.site.com. This policy applies on a frame-by-frame basis and not based on top level origin url alone, so e.g. if site-one.com is listed in the JavaScriptOptimizerBlockedForSites policy but site-one.com loads a frame containing site-two.com then site-one.com will have JavaScript optimizations disabled, but site-two.com will use the policy from DefaultJavaScriptOptimizerSetting, if set, or default to JavaScript optimizations enabled. Blocklist entries have higher priority than allowlist entries, which in turn have higher priority than the configured default value. If this policy is not set for a site then the policy from DefaultJavaScriptOptimizerSetting applies to the site, if set, otherwise JavaScript optimization is enabled for the site. Example value: [*.]example.edu

Sets a list of site url patterns that specify sites which will automatically deny the local fonts permission. This will limit the ability of sites to see information about local fonts. For detailed information on valid site url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. This policy only matches based on origin, so any path in the URL pattern is ignored. If this policy is not set for a site then the policy from DefaultLocalFontsSetting applies to the site, if set, otherwise the permission will follow the browser's defaults and allow users to choose this permission per site. Example value: https://www.example.com [*.]example.edu

Setting the policy lets you set a list of URL patterns that specify the sites that can't display notifications. Leaving the policy unset means DefaultNotificationsSetting applies for all sites, if it's set. If not, the user's personal setting applies. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Example value: https://www.example.com [*.]example.edu

Setting the policy lets you set a list of URL patterns that specify the sites that can't open pop-ups. Leaving the policy unset means DefaultPopupsSetting applies for all sites, if it's set. If not, the user's personal setting applies. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. Example value: https://www.example.com [*.]example.edu

Setting the policy lets you list the URL patterns that specify which sites can't ask users to grant them read access to files or directories in the host operating system's file system via the File System API. Leaving the policy unset means DefaultFileSystemReadGuardSetting applies for all sites, if it's set. If not, users' personal settings apply. URL patterns can't conflict with FileSystemReadAskForUrls. Neither policy takes precedence if a URL matches with both. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. * is not an accepted value for this policy. Example value: https://www.example.com [*.]example.edu

Setting the policy lets you list the URL patterns that specify which sites can't ask users to grant them access to a serial port. Leaving the policy unset means DefaultSerialGuardSetting applies for all sites, if it's set. If not, the user's personal setting applies. For URL patterns which do not match the policy SerialAskForUrls (if there is a match), DefaultSerialGuardSetting (if set), or the users' personal settings take precedence, in that order. If URL patterns conflict with SerialAskForUrls this policy will take precedence. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. * is not an accepted value for this policy. Example value: https://www.example.com [*.]example.edu

Setting the policy lets you list the URL patterns that specify which sites can't ask users to grant them access to a HID device. Leaving the policy unset means DefaultWebHidGuardSetting applies for all sites, if it's set. If not, users' personal settings apply. For URL patterns which do not match the policy, the following take precedence, in this order: * WebHidAskForUrls (if there is a match), * DefaultWebHidGuardSetting (if set), or * Users' personal settings. URL patterns can't conflict with WebHidAskForUrls. Neither policy takes precedence if a URL matches with both. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. * is not an accepted value for this policy. Example value: https://google.com https://chromium.org

Setting the policy lets you list the URL patterns that specify which sites can't ask users to grant them access to a USB device. Leaving the policy unset means DefaultWebUsbGuardSetting applies for all sites, if it's set. If not, the user's personal setting applies. URL patterns can't conflict with WebUsbAskForUrls. Neither policy takes precedence if a URL matches with both. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. * is not an accepted value for this policy. Example value: https://www.example.com [*.]example.edu

Allows you to set a list of site url patterns that specify sites which will automatically deny the window management permission. This will limit the ability of sites to see information about the device's screens and use that information to open and place windows or request fullscreen on specific screens. For detailed information on valid site url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. This policy only matches based on origin, so any path in the URL pattern is ignored. If this policy is not set for a site then the policy from DefaultWindowManagementSetting applies to the site, if set, otherwise the permission will follow the browser's defaults and allow users to choose this permission per site. This replaces the deprecated WindowPlacementBlockedForUrls policy. Example value: https://www.example.com [*.]example.edu

Setting the policy lets you list the URL patterns that specify which sites can't ask users to grant them write access to files or directories in the host operating system's file system. Leaving the policy unset means DefaultFileSystemWriteGuardSetting applies for all sites, if it's set. If not, users' personal settings apply. URL patterns can't conflict with FileSystemWriteAskForUrls. Neither policy takes precedence if a URL matches with both. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. * is not an accepted value for this policy. Example value: https://www.example.com [*.]example.edu

This policy controls whether Blob URLs are partitioned during fetching and navigation. If this policy is set to Enabled or not set, Blob URLs will be partitioned. If this policy is set to Disabled, Blob URLs won't be partitioned. If you must use the policy, please file a bug at Google Chrome explaining your use case. The policy is scheduled to be offered through Google Chrome version 146, after which the old implementation will be removed. NOTE: Only newly-started renderer processes will reflect changes to this policy while the browser is running. For detailed information on third-party storage partitioning, please see https://developers.google.com/privacy-sandbox/cookies/storage-partitioning.

Allows you to set whether users can add exceptions to allow mixed content for specific sites. This policy can be overridden for specific URL patterns using the 'InsecureContentAllowedForUrls' and 'InsecureContentBlockedForUrls' policies. If this policy is left not set, users will be allowed to add exceptions to allow blockable mixed content and disable autoupgrades for optionally blockable mixed content.

Allows you to set whether Google Chrome will run the v8 JavaScript engine with JIT (Just In Time) compiler enabled or not. Disabling the JavaScript JIT will mean that Google Chrome may render web content more slowly, and may also disable parts of JavaScript including WebAssembly. Disabling the JavaScript JIT may allow Google Chrome to render web content in a more secure configuration. This policy can be overridden for specific URL patterns using the JavaScriptJitAllowedForSites and JavaScriptJitBlockedForSites policies. If this policy is left not set, JavaScript JIT is enabled.

Allows you to set whether Google Chrome will run the v8 JavaScript engine with more advanced JavaScript optimizations enabled. Disabling JavaScript optimizations (by setting this policy's value to 2) will mean that Google Chrome may render web content more slowly. This policy can be overridden for specific URL patterns using the JavaScriptOptimizerAllowedForSites and JavaScriptOptimizerBlockedForSites policies. If this policy is left not set, JavaScript optimizations are enabled.

Setting the policy to 3 lets websites ask for read access to files and directories in the host operating system's file system via the File System API. Setting the policy to 2 denies access. Leaving it unset lets websites ask for access, but users can change this setting.

Setting the policy to 3 lets websites ask for write access to files and directories in the host operating system's file system. Setting the policy to 2 denies access. Leaving it unset lets websites ask for access, but users can change this setting.

Setting the policy to 3 lets websites ask for access to serial ports. Setting the policy to 2 denies access to serial ports. Leaving it unset lets websites ask for access, but users can change this setting.

Setting the policy to 3 lets websites ask for access to nearby Bluetooth devices. Setting the policy to 2 denies access to nearby Bluetooth devices. Leaving the policy unset lets sites ask for access, but users can change this setting.

Setting the policy to 3 lets websites ask for access to HID devices. Setting the policy to 2 denies access to HID devices. Leaving it unset lets websites ask for access, but users can change this setting. This policy can be overridden for specific url patterns using the WebHidAskForUrls and WebHidBlockedForUrls policies.

Setting the policy to 3 lets websites ask for access to connected USB devices. Setting the policy to 2 denies access to connected USB devices. Leaving it unset lets websites ask for access, but users can change this setting.

This policy enables Data URL support for SVGUseElement, which will be disabled by default starting in M119. If this policy is set to Enabled, Data URLs will continue to work in SVGUseElement. If this policy is set to Disabled or not set, Data URLs won't work in SVGUseElement.

Setting the policy to 1 lets websites download multiple files automatically. Setting the policy to 2 denies this permission. You can set the policy to ask whenever a website wants to download multiple files automatically. Leaving the policy unset means the AskAutomaticDownloads policy applies, but users can change this setting.

Setting the policy to 2 blocks sites from using the clipboard site permission. Setting the policy to 3 or leaving it unset lets the user change the setting and decide if the clipboard APIs are available when a site wants to use one. This policy can be overridden for specific URL patterns using the ClipboardAllowedForUrls and ClipboardBlockedForUrls policies. This policy only affects clipboard operations controlled by the clipboard site permission, and does not affect sanitized clipboard writes or trusted copy and paste operations.