Chrome Enterprise configuration hardening security checks
Vendor-recommended secure defaults, patch levels and housekeeping settings that drift as tenants grow and admins change.
On Chrome Enterprise, Black Cat runs 10 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Chrome Enterprise connector needs.
Checks (10)
severity: medium Sideloaded Extension Detected fix difficulty: medium #
Remove sideloaded extensions and enforce extension installation policy in Chrome Enterprise
- Navigate to Google Admin Console > Devices > Chrome > Apps & Extensions
- Review the flagged extension that was installed outside the Chrome Web Store
- If the extension is unauthorized, add it to the Blocked apps and extensions list
- Navigate to User & Browser Settings and enable Block all apps and extensions except the ones I allow
- Instruct affected users to remove the sideloaded extension from their browser
Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.2 DORA (SaaS Security) DORA-8.3
severity: medium Outdated Browser Version fix difficulty: medium #
Update Chrome browser to the latest stable version on affected devices
- Navigate to Google Admin Console > Devices > Chrome > Settings > Device Settings
- Under Updates, set the Auto-update policy to Always allow updates
- Set the minimum Chrome version to the latest stable release
- For devices that cannot auto-update, identify them via Admin Console > Devices > Chrome > Managed Browsers
- Push a manual update or re-enroll the device if automatic updates are not available
Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.2 DORA (SaaS Security) DORA-8.3
severity: high Extension With Risky Permissions fix difficulty: medium #
Block or remove Chrome extensions with risky permissions from managed devices
- Navigate to Google Admin Console > Devices > Chrome > Apps & Extensions
- Identify the flagged extension with risky permissions (e.g., read all browsing data, nativeMessaging)
- Evaluate whether the extension is business-critical and the permissions are justified
- If not justified, add the extension to the Blocked apps and extensions list
- If required for business use, document the approval and monitor the extension regularly
- Notify affected users of the policy change
Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.2 DORA (SaaS Security) DORA-8.3
severity: high Safe Browsing Disabled fix difficulty: easy #
Enable Safe Browsing in Chrome Enterprise to protect users from malicious sites and downloads
- Navigate to Google Admin Console > Devices > Chrome > Settings > User & Browser Settings
- Search for Safe Browsing in the policy search bar
- Set the policy to Always enable Safe Browsing
- Optionally enable Enhanced Safe Browsing for stronger protection
- Apply the policy to all organizational units and save changes
Satisfies: ISO 27001:2022 A.8.20 SOC 2 Type II CC6.6 CIS Controls v8 CIS-12.1 NIST CSF 2.0 PR.IR GDPR (SaaS Security) GDPR-5.1f.i HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.2
severity: medium Non-Stable Browser Channel In Use fix difficulty: easy #
Restrict Chrome browser channel to stable in Chrome Enterprise settings
- Navigate to Google Admin Console > Devices > Chrome > Settings > Device Settings
- Under Updates, locate the Target Channel Override policy
- Set the policy to Stable channel for all production organizational units
- Save changes and allow policy to propagate to managed devices
- Verify affected browser versions have moved to the stable channel
Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10
severity: medium Browser Running Windows 10 fix difficulty: hard #
Upgrade browsers running on Windows 10 to Windows 11 as Windows 10 reached end of support
- Navigate to Google Admin Console > Devices > Chrome > Managed Browsers
- Filter by OS to identify browsers running Windows 10
- Coordinate with the device owner or IT team to schedule an OS upgrade to Windows 11
- If the device cannot be upgraded, isolate it from sensitive systems and plan decommission
- After upgrade, verify the device appears with Windows 11 in the browser inventory
Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10
severity: high Widespread Outdated Browser Version fix difficulty: medium #
Prioritize updating outdated Chrome versions that are deployed on more than 100 devices
- Navigate to Google Admin Console > Devices > Chrome > Browser Versions
- Identify the outdated version affecting a large number of devices
- Review Chrome update policies to ensure auto-update is enabled for affected org units
- If auto-update is blocked by policy, remove the version pin and allow updates
- Monitor the version distribution report to confirm devices are updating
- Escalate to IT if specific devices remain on the outdated version after policy changes
Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10
severity: low Telemetry Device Missing OS Version fix difficulty: easy #
Investigate telemetry devices not reporting OS version to restore patch compliance visibility
- Navigate to Google Admin Console > Devices > Chrome > Telemetry
- Locate the device with missing OS version information
- Check if the device is powered on and connected to the network
- Verify that telemetry reporting is enabled in the device management policy
- If the device is offline, contact the device owner to bring it online
- Confirm OS version appears in the telemetry report after remediation
Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10
severity: low Browser Not Reporting Version fix difficulty: easy #
Investigate enrolled browsers not reporting their version to restore update compliance visibility
- Navigate to Google Admin Console > Devices > Chrome > Managed Browsers
- Locate the browser with missing version information
- Check if the browser enrollment token is still valid
- Verify that the browser reporting policy is enabled for the device's org unit
- Re-enroll the browser if the token has expired or the enrollment is stale
- Confirm the browser version appears in the inventory after remediation
Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10
severity: medium Extension Not Hosted on Chrome Web Store fix difficulty: medium #
Review Chrome extensions sourced outside the Chrome Web Store and restrict installation to approved sources
- Navigate to Google Admin Console > Devices > Chrome > Apps & Extensions
- Review the flagged extension and verify its publisher and source against your approved-software list
- If the extension is unauthorized, add it to the Blocked apps and extensions list
- Under Additional Settings, restrict Allow installation of apps and extensions to the Chrome Web Store sources you trust
- Instruct affected users to remove the extension and reinstall an approved version from the Chrome Web Store
Satisfies: NIS2 Directive NIS2-21.e.2 DORA (SaaS Security) DORA-8.3