4.12 Ensure 'Allow or deny screen capture' is set to 'Disabled'

Information

If enabled or not configured (default), a Web page can use screen-share APIs (e.g., getDisplayMedia() or the Desktop Capture extension API) to prompt the user to select a tab, window, or desktop to capture.

Rationale:

The end-user having the ability to allow or deny screen capture for websites in Google Chrome could open an organization up to a malicious site that may capture proprietary information through the browser. By limiting or disallowing screen capture, it removes the end-user's discretion, leaving it up to the organization which sites are allowed to use this ability.

Impact:

When this policy is disabled, any calls to screen-share APIs will fail with an error. This policy is not considered (and a site will be allowed to use screen-share APIs) if the site matches an origin pattern in any of the following policies: ScreenCaptureAllowedByOrigins, WindowCaptureAllowedByOrigins, TabCaptureAllowedByOrigins, SameOriginTabCaptureAllowedByOrigins.

Solution

To establish the recommended configuration via Group Policy, set the following UI path to Disabled:

Computer Configuration\Policies\Administrative Templates\Google\Google Chrome\Allow or deny screen capture\Allow or deny screen capture

Default Value:

Unset (Same as Enabled, but user can change)

See Also

https://workbench.cisecurity.org/benchmarks/8691

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7b.

Plugin: Windows

Control ID: 8f5d4b7a8f4e9b6dd257fcccb20a87d112f39b2f16eabc4834c8a62efc635d99