Brave Browser: 1.97.56 to 1.98.60

Master switch for Brave's local AI features (history embeddings and any future on-device AI surfaces). When this policy is set to true, the local AI feature surfaces (the [removed: chrome://history side bar toggle,][added: Semantic history search toggle in brave://settings/privacy,] the brave-history-embeddings chrome://flags entry, the EmbeddingGemma model component install, etc.) become available to the user. When this policy is set to false, every local AI surface is hidden and the on-device AI components are not installed. If you set this policy, users cannot change or override it. If this policy is left unset, local AI is enabled by default.

Setting the policy to [removed: True][added: Enabled] or leaving it unset lets users add, remove, modify, or upload bookmarks. Setting the policy to [removed: False][added: Disabled] means users can't add, remove, modify or upload bookmarks. They can still use existing bookmarks.

Allows you to set a list of site url patterns that specify sites which are allowed to run JavaScript with JIT (Just In Time) compiler enabled. For detailed information on valid site url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. [removed: JavaScript JIT][added: Policy exceptions can be set for specific subdomains as well as entire sites. For example, a] policy [removed: exceptions will][added: set for] only [added: subdomain.site.com applies to subdomain.site.com without affecting site.com. In some cases where a subdomain cannot ]be [removed: enforced at a site granularity (eTLD+1). A][added: isolated from its parent site, it may inherit the] policy set [added: on site.com. Exceptions may also not take effect ]for [removed: only subdomain.site.com][added: frames loaded in an existing tab until the site is opened in a new tab. On low-memory Android devices, site-specific exceptions may not be enforced, and sites] will [removed: not correctly apply][added: instead use the policy from DefaultJavaScriptJitSetting, if set, or default] to [removed: site.com][added: the profile's JavaScript JIT setting. To enforce exceptions, Brave may place sites or subdomains whose setting differs from the default into dedicated processes. This can increase memory usage, especially on Android] or [removed: subdomain.site.com][added: when a wildcard pattern matches many subdomains,] since [removed: they both resolve][added: each matching origin may be isolated separately. Isolated subdomains also cannot use document.domain] to [removed: the same eTLD+1 (site.com)][added: access their parent site. Note: In versions 155 and earlier, policy exceptions were only enforced at a site granularity (eTLD+1). A policy set] for [removed: which there is no policy. In this case, policy must][added: only subdomain.site.com did not take effect, even for subdomain.site.com; it had to] be set on site.com to apply [removed: correctly for ][added: to ]both site.com and subdomain.site.com. This policy applies on a frame-by-frame basis and not based on top level origin url alone, so e.g. if site-one.com is listed in the JavaScriptJitAllowedForSites policy but site-one.com loads a frame containing site-two.com then site-one.com will have JavaScript JIT enabled, but site-two.com will use the policy from DefaultJavaScriptJitSetting, if set, or default to JavaScript JIT enabled.[added: Blocklist entries have higher priority than allowlist entries, which in turn have higher priority than the configured default value.] If this policy is not set for a site then the policy from DefaultJavaScriptJitSetting applies to the site, if set, otherwise Javascript JIT is enabled for the site. Example value: [*.]example.edu

Allows you to set a list of site url patterns that specify sites which are not allowed to run JavaScript JIT (Just In Time) compiler enabled. Disabling the JavaScript JIT will mean that Brave may render web content more slowly, and may also disable parts of JavaScript including WebAssembly. Disabling the JavaScript JIT may allow Brave to render web content in a more secure configuration. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. [removed: JavaScript JIT][added: Policy exceptions can be set for specific subdomains as well as entire sites. For example, a] policy [removed: exceptions will][added: set for] only [added: subdomain.site.com applies to subdomain.site.com without affecting site.com. In some cases where a subdomain cannot ]be [removed: enforced at a site granularity (eTLD+1). A][added: isolated from its parent site, it may inherit the] policy set [added: on site.com. Exceptions may also not take effect ]for [removed: only subdomain.site.com][added: frames loaded in an existing tab until the site is opened in a new tab. On low-memory Android devices, site-specific exceptions may not be enforced, and sites] will [removed: not correctly apply][added: instead use the policy from DefaultJavaScriptJitSetting, if set, or default] to [removed: site.com][added: the profile's JavaScript JIT setting. To enforce exceptions, Brave may place sites or subdomains whose setting differs from the default into dedicated processes. This can increase memory usage, especially on Android] or [removed: subdomain.site.com][added: when a wildcard pattern matches many subdomains,] since [removed: they both resolve][added: each matching origin may be isolated separately. Isolated subdomains also cannot use document.domain] to [removed: the same eTLD+1 (site.com)][added: access their parent site. Note: In versions 155 and earlier, policy exceptions were only enforced at a site granularity (eTLD+1). A policy set] for [removed: which there is no policy. In this case, policy must][added: only subdomain.site.com did not take effect, even for subdomain.site.com; it had to] be set on site.com to apply [removed: correctly for ][added: to ]both site.com and subdomain.site.com. This policy applies on a frame-by-frame basis and not based on top level origin url alone, so e.g. if site-one.com is listed in the JavaScriptJitBlockedForSites policy but site-one.com loads a frame containing site-two.com then site-one.com will have JavaScript JIT disabled, but site-two.com will use the policy from DefaultJavaScriptJitSetting, if set, or default to JavaScript JIT enabled.[added: Blocklist entries have higher priority than allowlist entries, which in turn have higher priority than the configured default value.] If this policy is not set for a site then the policy from DefaultJavaScriptJitSetting applies to the site, if set, otherwise JavaScript JIT is enabled for the site. Example value: [*.]example.edu

Allows you to set a list of site url patterns that specify sites for which advanced JavaScript optimizations are enabled. For detailed information on valid site url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. [removed: JavaScript optimization policy exceptions will only be enforced at a site granularity (eTLD+1). A][added: Policy exceptions can be set for specific subdomains as well as entire sites. For example, a] policy set for only subdomain.site.com [added: applies to subdomain.site.com without affecting site.com. In some cases where a subdomain cannot be isolated from its parent site, it may inherit the policy set on site.com. Exceptions may also not take effect for frames loaded in an existing tab until the site is opened in a new tab. On low-memory Android devices, site-specific exceptions may not be enforced, and sites ]will [removed: not correctly apply][added: instead use the policy from DefaultJavaScriptOptimizerSetting, if set, or default] to [removed: site.com][added: the profile's JavaScript optimization setting. To enforce exceptions, Brave may place sites or subdomains whose setting differs from the default into dedicated processes. This can increase memory usage, especially on Android] or [removed: subdomain.site.com][added: when a wildcard pattern matches many subdomains,] since [removed: they both resolve to the same eTLD+1 (site.com) for which there is no policy.][added: each matching origin may be isolated separately. Isolated subdomains also cannot use document.domain to access their parent site. Note:] In [removed: this case,][added: versions 138 and earlier, policy exceptions were only enforced at a site granularity (eTLD+1). A] policy[removed: must][added: set for only subdomain.site.com did not take effect, even for subdomain.site.com; it had to] be set on site.com to[removed: ][added: ]apply [removed: correctly for ][added: to ]both site.com and[removed: ][added: ]subdomain.site.com. This policy applies on a frame-by-frame basis and not based on top level origin url alone, so e.g. if site-one.com is listed in the JavaScriptOptimizerAllowedForSites policy but site-one.com loads a frame containing site-two.com then site-one.com will have JavaScript optimizations enabled, but site-two.com will use the policy from DefaultJavaScriptOptimizerSetting, if set, or default to JavaScript optimizations enabled. Blocklist entries have higher priority than allowlist entries, which in turn have higher priority than the configured default value. If this policy is not set for a site then the policy from DefaultJavaScriptOptimizerSetting applies to the site, if set, otherwise Javascript optimization is enabled for the site. Example value: [*.]example.edu

Allows you to set a list of site url patterns that specify sites for which advanced JavaScript optimizations are disabled. Disabling JavaScript optimizations will mean that Brave may render web content more slowly. For detailed information on valid url patterns, please see https://chromeenterprise.google/policies/url-patterns. Wildcards, *, are allowed. [removed: JavaScript optimization policy exceptions will only be enforced at a site granularity (eTLD+1). A][added: Policy exceptions can be set for specific subdomains as well as entire sites. For example, a] policy set for only subdomain.site.com [added: applies to subdomain.site.com without affecting site.com. In some cases where a subdomain cannot be isolated from its parent site, it may inherit the policy set on site.com. Exceptions may also not take effect for frames loaded in an existing tab until the site is opened in a new tab. On low-memory Android devices, site-specific exceptions may not be enforced, and sites ]will [removed: not correctly apply][added: instead use the policy from DefaultJavaScriptOptimizerSetting, if set, or default] to [removed: site.com][added: the profile's JavaScript optimization setting. To enforce exceptions, Brave may place sites or subdomains whose setting differs from the default into dedicated processes. This can increase memory usage, especially on Android] or [removed: subdomain.site.com][added: when a wildcard pattern matches many subdomains,] since [removed: they both resolve to the same eTLD+1 (site.com) for which there is no policy.][added: each matching origin may be isolated separately. Isolated subdomains also cannot use document.domain to access their parent site. Note:] In [removed: this case,][added: versions 138 and earlier, policy exceptions were only enforced at a site granularity (eTLD+1). A] policy[removed: must][added: set for only subdomain.site.com did not take effect, even for subdomain.site.com; it had to] be set on site.com to[removed: ][added: ]apply [removed: correctly for ][added: to ]both site.com and[removed: ][added: ]subdomain.site.com. This policy applies on a frame-by-frame basis and not based on top level origin url alone, so e.g. if site-one.com is listed in the JavaScriptOptimizerBlockedForSites policy but site-one.com loads a frame containing site-two.com then site-one.com will have JavaScript optimizations disabled, but site-two.com will use the policy from DefaultJavaScriptOptimizerSetting, if set, or default to JavaScript optimizations enabled. Blocklist entries have higher priority than allowlist entries, which in turn have higher priority than the configured default value. If this policy is not set for a site then the policy from DefaultJavaScriptOptimizerSetting applies to the site, if set, otherwise JavaScript optimization is enabled for the site. Example value: [*.]example.edu

This policy configures Brave to order its preferred encryption ciphers in TLS 1.3 to reflect a preference for algorithms that have been approved by a specific compliance regime. Setting this policy does not guarantee that any specific algorithms will be negotiated. This policy exists to allow server operators who wish to support clients with and without compliance requirements to differentiate between those clients, and only use certain non-default algorithms with increased cryptographic strength for those explicitly configured to prefer them. Setting the policy to 'cnsa' configures Brave to prefer ciphers required for compliance with the Commercial National Security Algorithm Suite versions 1.0 and 2.0 (CNSA 1.0 and 2.0). Not setting the policy, or setting it to 'default', configures Brave to use its default ciphers. Setting this policy is not required for security. The default cryptography used by Brave is strong enough to withstand a brute force attack using the entire power of the Sun. Setting this policy will cause Brave to be slower when accessing websites. This policy only affects TLS 1.3 and QUIC; it does not affect earlier versions of TLS. [added: This policy can be set for the machine and for the user. If set for the user, this policy only affects network requests initiated by the user profile, and may not affect network requests made by Brave to carry out browser-wide background tasks; those are controlled by the machine-level value. If this policy is set at both the machine level and the user level, the machine-level value applies, unless the policy precedence order has been changed by the CloudUserPolicyOverridesCloudMachinePolicy policy. For versions 155 and below, this policy is machine-wide only. ]Example value: cnsa

This policy configures Brave to order its preferred key agreement algorithms (supported groups) in TLS 1.3 to reflect a preference for algorithms that have been approved by a specific compliance regime. Setting this policy does not guarantee that any specific algorithms will be negotiated. This policy exists to allow server operators who wish to support clients with and without compliance requirements to differentiate between those clients, and only use certain non-default algorithms with increased cryptographic strength for those explicitly configured to prefer them. Setting the policy to 'cnsa2' configures Brave to prefer key exchange methods required for compliance with the Commercial National Security Algorithm Suite 2.0 (CNSA 2.0). Not setting the policy, or setting it to 'default', configures Brave to use its default key exchange methods. Setting this policy is not required for security. The default cryptography used by Brave is strong enough to withstand a brute force attack using the entire power of the Sun. Setting this policy will cause Brave to be slower when accessing websites. This policy only affects TLS 1.3 and QUIC; it does not affect earlier versions of TLS. [added: This policy can be set for the machine and for the user. If set for the user, this policy only affects network requests initiated by the user profile, and may not affect network requests made by Brave to carry out browser-wide background tasks; those are controlled by the machine-level value. If this policy is set at both the machine level and the user level, the machine-level value applies, unless the policy precedence order has been changed by the CloudUserPolicyOverridesCloudMachinePolicy policy. For versions 155 and below, this policy is machine-wide only. ]Example value: cnsa2