4.9 Ensure 'Enable AutoFill for credit cards' is set to 'Disabled'

Information

Chrome allows users to auto-complete web forms with saved credit card information. Disabling this feature will prompt a user to enter all information manually.

The recommended state for this setting is: Disabled (0)

Rationale:

If an attacker gains access to a user's machine where the user has stored credit card AutoFill data, information could be harvested.

Impact:

If this setting is disabled, credit card AutoFill will be inaccessible to users.

Solution

To establish the recommended configuration via Group Policy, set the following UI path to Disabled:

Computer Configuration\Administrative Templates\Google\Google Chrome\Enable AutoFill for credit cards

Default Value:

Unset (Same as Enabled, but user can change)

See Also

https://workbench.cisecurity.org/benchmarks/8691

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-8, CSCv7|4.8

Plugin: Windows

Control ID: da68941ec0084205b723d05f79904d3989bf0a9a302a968bf415330ee29349fe