Is your feature request related to a problem? Please describe.
I'd like to suggest an additional browser hardening control to include in the ClickFix / paste-run guidance: blocking javascript://* via the Chromium URLBlocklist policy (supported in both Edge and Chrome).
Describe the solution you'd like
ClickFix-style attacks rely on socially engineering a user into pasting attacker-supplied content into the browser. Chromium already strips a leading javascript: scheme on paste as a built-in mitigation, but that behaviour can be bypassed (e.g., a user manually typing javascript: first and then pasting the payload). Adding a URLBlocklist entry provides defence-in-depth by blocking execution of javascript: URLs outright.
This aligns with the DISA STIG for Google Chrome, V-221572, which uses URLBlocklist to block javascript://*: https://www.stigviewer.com/stigs/google_chrome_current_windows/2024-08-22/finding/V-221572
Testing (Microsoft Edge v153):
Before applying the policy — typing javascript: and then pasting either of the following resulted in execution:
javascript:alert(1)
javascript:document.location='https://example.com'
After applying the policy (local test):
$Path = 'HKLM:\SOFTWARE\Policies\Microsoft\Edge\URLBlocklist'
New-Item -Path $Path -Force | Out-Null
New-ItemProperty -Path $Path -Name '1' -Value 'javascript://*' -PropertyType String -Force | Out-Null
Result: Both payloads were blocked and no longer executed.
Revert (local test cleanup):
Remove-Item 'HKLM:\SOFTWARE\Policies\Microsoft\Edge\URLBlocklist' -Recurse -Force
Closing:
Given the low risk and alignment with the existing Chrome STIG, please consider adding javascript://* to the URLBlocklist ("Block access to a list of URLs") for Edge as a ClickFix mitigation. Although it's not in the Microsoft or CIS baselines, it would be similar to the Notifications block that was previously added to the Edge policy.
Is your feature request related to a problem? Please describe.
I'd like to suggest an additional browser hardening control to include in the ClickFix / paste-run guidance: blocking javascript://* via the Chromium URLBlocklist policy (supported in both Edge and Chrome).
Describe the solution you'd like
ClickFix-style attacks rely on socially engineering a user into pasting attacker-supplied content into the browser. Chromium already strips a leading javascript: scheme on paste as a built-in mitigation, but that behaviour can be bypassed (e.g., a user manually typing javascript: first and then pasting the payload). Adding a URLBlocklist entry provides defence-in-depth by blocking execution of javascript: URLs outright.
This aligns with the DISA STIG for Google Chrome, V-221572, which uses URLBlocklist to block javascript://*: https://www.stigviewer.com/stigs/google_chrome_current_windows/2024-08-22/finding/V-221572
Testing (Microsoft Edge v153):
Before applying the policy — typing javascript: and then pasting either of the following resulted in execution:
After applying the policy (local test):
Result: Both payloads were blocked and no longer executed.
Revert (local test cleanup):
Remove-Item 'HKLM:\SOFTWARE\Policies\Microsoft\Edge\URLBlocklist' -Recurse -ForceClosing:
Given the low risk and alignment with the existing Chrome STIG, please consider adding javascript://* to the URLBlocklist ("Block access to a list of URLs") for Edge as a ClickFix mitigation. Although it's not in the Microsoft or CIS baselines, it would be similar to the Notifications block that was previously added to the Edge policy.