Details
Google Chrome can use a list of origins (URLs) or hostname patterns (such as ‘*.example.com’) for which security restrictions on insecure origins will not apply and are prevented from being labeled as ‘Not Secure’ in the omnibox.
The recommended state for this setting is: Disabled (0)
Rationale:
Insecure contexts shall always be labeled as insecure.
Impact:
None – This is the default behavior.
Solution
To establish the recommended configuration via Group Policy, set the following UI path to Disabled:
Computer ConfigurationPoliciesAdministrative TemplatesGoogleGoogle ChromeOrigins or hostname patterns for which restrictions on insecure origins should not apply
Default Value:
Unset (Same as Disabled, but user can change)
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Windows.