Brave Browser: 1.88.136 to 1.89.141

Setting the policy controls extension management settings for Brave, including any controlled by existing extension-related policies.[removed: The policy supersedes any legacy policies that might be set.] This policy maps an extension ID or an update URL to its specific setting only. A default configuration can be set for the special ID "*", which applies to all extensions without a custom configuration in this policy.[added: This policy can override per-extension config from legacy policies. Note that any per-ID extension setting from either ExtensionInstallForcelist, ExtensionInstallAllowlist, ExtensionInstallBlocklist, or ExtensionSettings will only inherit 'installation_mode' and 'update_url' from the "*" defaults. It will not inherit any other properties.] With an update URL, configuration applies to extensions with the exact update URL stated in the extension manifest ( http://support.google.com/chrome/a?p=Configure_ExtensionSettings_policy ). If the 'override_update_url' flag is set to true, the extension is installed and updated using the "update" URL specified in the ExtensionInstallForcelist policy or in 'update_url' field in this policy. The flag 'override_update_url' is ignored if the 'update_url' is a Chrome Web Store url. On Microsoft® Windows® instances, apps and extensions from outside the Chrome Web Store can only be forced installed if the instance is joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Chrome Enterprise Core. On macOS instances, apps and extensions from outside the Chrome Web Store can only be force installed if the instance is managed via MDM, joined to a domain via MCX or enrolled in Chrome Enterprise Core. Note: This policy only applies to platforms that support extensions. See https://cloud.google.com/docs/chrome-enterprise/policies/?policy=ExtensionSettings for more information about schema and formatting. Example value: { "*": { "allowed_types": [ "hosted_app" ], "blocked_install_message": "Custom error message.", "blocked_permissions": [ "downloads", "bookmarks" ], "install_sources": [ "https://company-intranet/chromeapps" ], "installation_mode": "blocked", "runtime_allowed_hosts": [ "*://good.example.com" ], "runtime_blocked_hosts": [ "*://*.example.com" ] }, "abcdefghijklmnopabcdefghijklmnop": { "blocked_permissions": [ "history" ], "installation_mode": "allowed", "minimum_version_required": "1.0.1", "toolbar_pin": "force_pinned", "file_url_navigation_allowed": true }, "bcdefghijklmnopabcdefghijklmnopa": { "allowed_permissions": [ "downloads" ], "installation_mode": "force_installed", "runtime_allowed_hosts": [ "*://good.example.com" ], "runtime_blocked_hosts": [ "*://*.example.com" ], "update_url": "https://example.com/update_url" }, "cdefghijklmnopabcdefghijklmnopab": { "blocked_install_message": "Custom error message.", "installation_mode": "blocked" }, "defghijklmnopabcdefghijklmnopabc,efghijklmnopabcdefghijklmnopabcd": { "blocked_install_message": "Custom error message.", "installation_mode": "blocked" }, "fghijklmnopabcdefghijklmnopabcde": { "blocked_install_message": "Custom removal message.", "installation_mode": "removed" }, "ghijklmnopabcdefghijklmnopabcdef": { "installation_mode": "force_installed", "override_update_url": true, "update_url": "https://example.com/update_url" }, "update_url:https://www.example.com/update.xml": { "allowed_permissions": [ "downloads" ], "blocked_permissions": [ "wallpaper" ], "installation_mode": "allowed" } }

This policy configures Brave to order its preferred key agreement algorithms (supported groups) in TLS 1.3 to reflect a preference for algorithms that have been approved by a specific compliance regime. Setting this policy does not guarantee that any specific algorithms will be negotiated. This policy exists to allow server operators who wish to support clients with and without compliance requirements to differentiate between those clients, and only use certain non-default algorithms with increased cryptographic strength for those explicitly configured to prefer them. Setting the policy to 'cnsa2' configures Brave to prefer key exchange methods required for compliance with the Commercial National Security Algorithm Suite 2.0 (CNSA 2.0). Not setting the policy, or setting it to 'default', configures Brave to use its default key exchange methods. [removed: If this policy is set to a value that would configure Brave to prefer a post-quantum key agreement algorithm but PostQuantumKeyAgreementEnabled is Disabled, the setting of PostQuantumKeyAgreementEnabled takes precedence. ]Setting this policy is not required for security. The default cryptography used by Brave is strong enough to withstand a brute force attack using the entire power of the Sun. Setting this policy will cause Brave to be slower when accessing websites. This policy only affects TLS 1.3 and QUIC; it does not affect earlier versions of TLS. Example value: cnsa2

Setting the URLBlocklist policy stops web pages with prohibited URLs from loading. Administrators can specify the list of URL patterns to be blocked. If left unset, no URLs are blocked in the browser. Up to 1,000 exceptions can be defined in URLAllowlist. See how to format a URL pattern ( https://support.google.com/chrome/a?p=url_blocklist_filter_format ). Note: This policy does not apply to in-page JavaScript URLs with dynamically loaded data. If you blocked example.com/abc, then example.com could still load it using XMLHTTPRequest. Additionally, this policy does not prevent web pages from updating the URL shown in the omnibox to a blocked one using the JavaScript History API. From Brave version 73, you can block javascript://* URLs. But, this only affects JavaScript entered in the address bar or, for example, bookmarklets. From Brave version 92, this policy is also supported in the headless mode. [added: From Brave version 147, the wildcard * on its own does not apply to internal chrome:// URLs. To block these, you must explicitly use the chrome://* pattern. ]Note: Blocking internal chrome://* and chrome-untrusted://* URLs can lead to unexpected errors or can be circumvented in some cases. Instead of blocking certain internal URLs, see if there are more specific policies available. For example: - Instead of blocking chrome://settings/certificates, use CACertificateManagementAllowed. - Instead of blocking chrome-untrusted://crosh, use SystemFeaturesDisableList.[added: - Instead of blocking devtools://*, use one of the DeveloperToolsAvailability, DeveloperToolsAvailabilityAllowlist or DeveloperToolsAvailabilityBlocklist policies.] Example value: example.com https://ssl.server.com hosting.com/bad_path https://server:8080/path .exact.hostname.com file://* custom_scheme:* *