<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-browser-security-controls
description: >-
  Implement and enforce browser security controls including extension
  management, content security policies, site isolation, certificate
  pinning, download restrictions, and enterprise browser policy deployment
  to reduce the web-based attack surface on endpoints.
domain: cybersecurity
subdomain: endpoint-security
tags:
  - browser-security
  - extension-management
  - content-security-policy
  - site-isolation
  - enterprise-policy
  - download-control
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1189", "T1204.001", "T1176"]
  tools: [python3, powershell, chrome-policy, reg]
---

# Implementing Browser Security Controls

## Overview

Browsers are the primary interface to untrusted content. Hardening requires
extension whitelisting, enforcing site isolation, restricting dangerous
downloads, deploying Content Security Policy headers, and managing enterprise
policies via GPO or MDM. This reduces drive-by download, malicious extension,
and credential theft attack surfaces.

## Prerequisites

| Requirement | Purpose |
|---|---|
| GPO or MDM platform | Deploy browser policies at scale |
| Admin access | Configure registry/policy settings |
| Extension inventory | Audit currently installed extensions |
| Web proxy logs | Monitor browser network activity |

## Workflow

### Step 1: Audit Installed Extensions

```powershell
# Chrome — list installed extensions
$profiles = Get-ChildItem "$env:LOCALAPPDATA\Google\Chrome\User Data" -Filter "Profile*" -Directory
foreach ($p in $profiles) {
    $extDir = Join-Path $p.FullName "Extensions"
    if (Test-Path $extDir) {
        Get-ChildItem $extDir -Directory | ForEach-Object {
            $manifest = Get-ChildItem $_.FullName -Recurse -Filter "manifest.json" | Select-Object -First 1
            if ($manifest) {
                $json = Get-Content $manifest.FullName | ConvertFrom-Json
                [PSCustomObject]@{
                    Profile = $p.Name
                    ExtensionId = $_.Name
                    Name = $json.name
                    Version = $json.version
                    Permissions = ($json.permissions -join ", ")
                }
            }
        }
    }
}
```

### Step 2: Deploy Extension Whitelist Policy

```powershell
# Chrome — block all extensions except whitelisted
# ExtensionInstallBlocklist: * (block all)
# ExtensionInstallAllowlist: specific extension IDs
reg add "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "*" /f
reg add "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist" /v 1 /t REG_SZ /d "cjpalhdlnbpafiamejdnhcphjbkeiagm" /f

# Edge — same pattern
reg add "HKLM\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "*" /f
```

### Step 3: Enforce Security Policies

```python
# Generate Chrome enterprise policy JSON
import json

CHROME_POLICY = {
    "SitePerProcess": True,
    "BrowserNetworkTimeQueriesEnabled": True,
    "SafeBrowsingEnabled": True,
    "SafeBrowsingExtendedReportingEnabled": False,
    "DownloadRestrictions": 1,  # Block dangerous downloads
    "DefaultPopupsSetting": 2,  # Block popups
    "DefaultJavaScriptJitSetting": 2,  # Disable JIT (hardening)
    "PasswordManagerEnabled": False,  # Use enterprise password manager
    "AutofillCreditCardEnabled": False,
    "AdvancedProtectionAllowed": True,
    "DnsOverHttpsMode": "automatic",
    "SSLVersionMin": "tls1.2",
    "InsecureContentAllowedForUrls": [],
}

print(json.dumps(CHROME_POLICY, indent=2))
```

### Step 4: Download and Navigation Restrictions

```powershell
# Block dangerous file type downloads
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v DownloadRestrictions /t REG_DWORD /d 1 /f

# Block navigation to data: URLs from external origins
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v BlockExternalExtensions /t REG_DWORD /d 1 /f

# Force Safe Browsing
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v SafeBrowsingProtectionLevel /t REG_DWORD /d 2 /f
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Unapproved extension install | Browser policy logs | Extension not in whitelist |
| JIT re-enabled | Policy audit | JavaScript JIT bypass attempt |
| Dangerous download blocked | Proxy/browser logs | Executable download intercepted |

```yaml
title: Unauthorized Browser Extension Installation
id: e5f6a7b8-c901-2345-defg-678901234567
status: experimental
description: Detects installation of browser extensions not in enterprise whitelist
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\chrome.exe'
    CommandLine|contains: '--load-extension'
  condition: selection
falsepositives:
  - Developer mode testing
level: medium
tags:
  - attack.t1176
  - attack.persistence
```

## Verification

- [ ] Extension whitelist enforced — unapproved installs blocked
- [ ] Site isolation enabled across all managed browsers
- [ ] Dangerous download types blocked at browser level
- [ ] Safe Browsing enabled and set to Enhanced protection
- [ ] TLS minimum version set to 1.2
- [ ] JIT disabled where performance permits

## References

- [Chrome Enterprise Policy List](https://chromeenterprise.google/policies/)
- [MITRE T1176 — Browser Extensions](https://attack.mitre.org/techniques/T1176/)
- [CIS Google Chrome Benchmark](https://www.cisecurity.org/benchmark/google_chrome)

---
v1.0 | Validated: 2026-03-18
