Google › Google Chrome

Origins or hostname patterns for which restrictions on insecure origins should not apply

Computer and userIntune-readyOverrideSecurityRestrictionsOnInsecureOrigin

Supported on Microsoft Windows 7 or later

155.0.8059.85

What it does

Setting the policy specifies a list of origins (URLs) or hostname patterns (such as *.example.com) for which security restrictions on insecure origins won't apply. Patterns are only accepted for hostnames; URLs/origins with schemes must be exact strings. Organizations can specify origins for legacy applications that can't deploy TLS or set up a staging server for internal web development, so developers can test out features requiring secure contexts without having to deploy TLS on the staging server. This policy also prevents the origin from being labeled "Not Secure" in the address bar. Setting a list of URLs in this policy amounts to setting the command-line flag --unsafely-treat-insecure-origin-as-secure to a comma-separated list of the same URLs. The policy overrides the command-line flag and UnsafelyTreatInsecureOriginAsSecure, if present. For more information on secure contexts, see Secure Contexts ( https://www.w3.org/TR/secure-contexts ). Example value: http://testserver.example.com/ *.example.org

What it writes

Hive: HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER
Registry key: Software\Policies\Google\Chrome

Options

Option	Type	Registry value	Allowed values
Origins or hostname patterns for which restrictions on insecure origins should not apply	List of values	`Software\Policies\Google\Chrome\OverrideSecurityRestrictionsOnInsecureOrigin`	Any

Configure and deploy

Choose a state and the option values; the output below is generated from the template for exactly that.

Enabled · Computer · template defaults

Registry file (.reg)

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\OverrideSecurityRestrictionsOnInsecureOrigin]

PowerShell

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Origins or hostname patterns for which restrictions on insecure origins should not apply
# Name: OverrideSecurityRestrictionsOnInsecureOrigin
# Scope: Machine
# State: Enabled
# Source: chrome.admx

Clear-RegistryKeyValues -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\OverrideSecurityRestrictionsOnInsecureOrigin'

The OMA-URI is an inferred ADMX-backed Policy CSP candidate derived from the source ADMX file name and policy name.
Some Microsoft policies use built-in Policy CSP pages whose area names don't match the ADMX file name, so verify the candidate against Microsoft Learn before deployment.
The generated payload is incomplete because one or more ADMX element values were not supplied: OverrideSecurityRestrictionsOnInsecureOriginDesc

ADMX profile candidate (OMA-URI)

./Device/Vendor/MSFT/Policy/Config/ADMX_chrome/OverrideSecurityRestrictionsOnInsecureOrigin

Intune remediation scripts

Detection

$ErrorActionPreference = 'Stop'
$reasons = [System.Collections.Generic.List[string]]::new()

function Test-RegistryValueExists {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    return $null -ne (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue)
}

function Test-RegistryValueEquals {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $Kind,
        [Parameter(Mandatory = $true)][object] $Expected
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    $valueObject = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue
    if ($null -eq $valueObject) {
        return $false
    }

    $actual = $valueObject.$Name
    switch ($Kind) {
        'String' { return [string]$actual -ceq [string]$Expected }
        'ExpandString' { return [string]$actual -ceq [string]$Expected }
        'DWord' { return [uint32]$actual -eq [uint32]$Expected }
        'QWord' { return [uint64]$actual -eq [uint64]$Expected }
        'MultiString' {
            $actualArray = @($actual)
            $expectedArray = @($Expected)
            if ($actualArray.Count -ne $expectedArray.Count) { return $false }
            for ($index = 0; $index -lt $actualArray.Count; $index++) {
                if ([string]$actualArray[$index] -cne [string]$expectedArray[$index]) { return $false }
            }
            return $true
        }
        'Binary' {
            $actualArray = [byte[]]$actual
            $expectedArray = [byte[]]$Expected
            if ($actualArray.Length -ne $expectedArray.Length) { return $false }
            for ($index = 0; $index -lt $actualArray.Length; $index++) {
                if ($actualArray[$index] -ne $expectedArray[$index]) { return $false }
            }
            return $true
        }
        default { return [string]$actual -ceq [string]$Expected }
    }
}

# Policy: Origins or hostname patterns for which restrictions on insecure origins should not apply
# Name: OverrideSecurityRestrictionsOnInsecureOrigin
# Scope: Machine
# State: Enabled
# Source: chrome.admx

$keyPath = 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\OverrideSecurityRestrictionsOnInsecureOrigin'
if (Test-Path -LiteralPath $keyPath) {
    $propertyNames = (Get-Item -LiteralPath $keyPath).Property
    if ($propertyNames.Count -gt 0) {
        $reasons.Add('Key should be empty: HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\OverrideSecurityRestrictionsOnInsecureOrigin') | Out-Null
    }
}

if ($reasons.Count -eq 0) {
    Write-Output 'Compliant'
    exit 0
}

$reasons | ForEach-Object { Write-Output $_ }
exit 1

Remediation

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Origins or hostname patterns for which restrictions on insecure origins should not apply
# Name: OverrideSecurityRestrictionsOnInsecureOrigin
# Scope: Machine
# State: Enabled
# Source: chrome.admx

Clear-RegistryKeyValues -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\OverrideSecurityRestrictionsOnInsecureOrigin'

History 1 retained release

155.0.8059.8519 Oct 2026
- Already present in the first release ChangeIntel keeps.

Template

Internal name: OverrideSecurityRestrictionsOnInsecureOrigin
Namespace: Google.Policies.Chrome
Template file: chrome.admx
Release: Google Chrome 155.0.8059.85 · file set 1f03ffd12695d620…

Definition, editor controls and support

Definition

<policy class="Both" displayName="$(string.OverrideSecurityRestrictionsOnInsecureOrigin)" explainText="$(string.OverrideSecurityRestrictionsOnInsecureOrigin_Explain)" key="Software\Policies\Google\Chrome" name="OverrideSecurityRestrictionsOnInsecureOrigin" presentation="$(presentation.OverrideSecurityRestrictionsOnInsecureOrigin)" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Google.Policies.Chrome:googlechrome" />
      <supportedOn ref="Google.Policies.Chrome:SUPPORTED_WIN7" />
      <elements>
        <list id="OverrideSecurityRestrictionsOnInsecureOriginDesc" key="Software\Policies\Google\Chrome\OverrideSecurityRestrictionsOnInsecureOrigin" valuePrefix="" />
      </elements>
    </policy>

Editor controls

<presentation id="OverrideSecurityRestrictionsOnInsecureOrigin" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions"><listBox refId="OverrideSecurityRestrictionsOnInsecureOriginDesc">Origins or hostname patterns for which restrictions on insecure origins should not apply</listBox></presentation>

Supported platforms and category

Google.Policies.Chrome:category:googlechrome
<category displayName="$(string.googlechrome)" name="googlechrome" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Google.Policies:Cat_Google" />
    </category>
Google.Policies.Chrome:definition:SUPPORTED_WIN7
<definition displayName="$(string.SUPPORTED_WIN7)" name="SUPPORTED_WIN7" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Google.Policies:category:Cat_Google
<category displayName="$(string.google)" name="Cat_Google" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Google.Policies.Chrome:category:googlechrome
<category displayName="$(string.googlechrome)" name="googlechrome" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Google.Policies:Cat_Google" />
    </category>
<strings><string id="Google.Policies.Chrome:googlechrome">Google Chrome</string></strings>
Google.Policies.Chrome:definition:SUPPORTED_WIN7
<definition displayName="$(string.SUPPORTED_WIN7)" name="SUPPORTED_WIN7" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Google.Policies.Chrome:SUPPORTED_WIN7">Microsoft Windows 7 or later</string></strings>
Google.Policies:category:Cat_Google
<category displayName="$(string.google)" name="Cat_Google" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Google.Policies:google">Google</string></strings>