• Chrome (Windows) since version 140

Enable the Live Caption feature.

If this policy is set to Enabled, Live Caption will always be turned on.

If this policy is set to Disabled, Live Caption will always be turned off.

If you set this policy as mandatory, users cannot change or override it.

If this policy is left unset, Live Caption is disabled initially but can be enabled by the user anytime.

true = Enable Live Caption
false = Disable Live Caption
not set = Allow the user to decide

• Chrome (Windows) since version 133

Enable translation of live captions. Captions will be sent to Google for translation.

If this policy is set to Enabled, Live Translate will always be turned on.

If this policy is set to Disabled, Live Translate will always be turned off.

If you set this policy as mandatory, users cannot change or override it.

If this policy is left unset, Live Translate is disabled initially but can be enabled by the user anytime.

In LiveCaptionEnabled is set to Disabled, Live Translate will be disabled regardless of this policy setting.

true = Enable Live Translate
false = Disable Live Translate
not set = Allow the user to decide

• Chrome (Windows) since version 95

Setting the policy lets you set a list of URL patterns that can capture tabs with their same Origin.

Leaving the policy unset means that sites will not be considered for an override at this level of capture.

If a site matches a URL pattern in this policy, the following policies will not be considered: TabCaptureAllowedByOrigins, WindowCaptureAllowedByOrigins, ScreenCaptureAllowedByOrigins, ScreenCaptureAllowed.

For detailed information on valid URL patterns, see the documentation for URL patterns. This policy only matches based on origin, so any path in the URL pattern is ignored.

Windows (Windows clients):

Software\Policies\Samsung\Internet\SameOriginTabCaptureAllowedByOrigins\1 = "https://www.example.com" Software\Policies\Samsung\Internet\SameOriginTabCaptureAllowedByOrigins\2 = "[*.]example.edu"

• Chrome (Windows) since version 95

Setting the policy lets you set a list of URL patterns that can use Desktop, Window, and Tab Capture.

Leaving the policy unset means that sites will not be considered for an override at this level of Capture.

This policy is not considered if a site matches a URL pattern in any of the following policies: WindowCaptureAllowedByOrigins, TabCaptureAllowedByOrigins, SameOriginTabCaptureAllowedByOrigins.

If a site matches a URL pattern in this policy, the ScreenCaptureAllowed will not be considered.

This policy only matches based on origin, so any path in the URL pattern is ignored.

Windows (Windows clients):

Software\Policies\Samsung\Internet\ScreenCaptureAllowedByOrigins\1 = "https://www.example.com" Software\Policies\Samsung\Internet\ScreenCaptureAllowedByOrigins\2 = "[*.]example.edu"

• Chrome (Windows) since version 95

Setting the policy lets you set a list of URL patterns that can use Tab Capture.

Leaving the policy unset means that sites will not be considered for an override at this level of capture.

This policy is not considered if a site matches a URL pattern in the SameOriginTabCaptureAllowedByOrigins policy.

If a site matches a URL pattern in this policy, the following policies will not be considered: WindowCaptureAllowedByOrigins, ScreenCaptureAllowedByOrigins, ScreenCaptureAllowed.

This policy only matches based on origin, so any path in the URL pattern is ignored.

Windows (Windows clients):

Software\Policies\Samsung\Internet\TabCaptureAllowedByOrigins\1 = "https://www.example.com" Software\Policies\Samsung\Internet\TabCaptureAllowedByOrigins\2 = "[*.]example.edu"

• Chrome (Windows) since version 95

Setting the policy lets you set a list of URL patterns that can use Window and Tab Capture.

Leaving the policy unset means that sites will not be considered for an override at this level of Capture.

This policy is not considered if a site matches a URL pattern in any of the following policies: TabCaptureAllowedByOrigins, SameOriginTabCaptureAllowedByOrigins.

If a site matches a URL pattern in this policy, the following policies will not be considered: ScreenCaptureAllowedByOrigins, ScreenCaptureAllowed.

For detailed information on valid URL patterns, see the documentation for URL patterns. This policy only matches based on origin, so any path in the URL pattern is ignored.

Windows (Windows clients):

Software\Policies\Samsung\Internet\WindowCaptureAllowedByOrigins\1 = "https://www.example.com" Software\Policies\Samsung\Internet\WindowCaptureAllowedByOrigins\2 = "[*.]example.edu"

• Chrome (Windows) since version 132

Setting the policy to All (0) or leaving it unset lets users edit trust settings for all CA certificates, remove user-imported certificates, and import certificates using Certificate Manager. Setting the policy to UserOnly (1) lets users manage only user-imported certificates, but not change trust settings of built-in certificates. Setting it to None (2) lets users view (not manage) CA certificates.

0 = Allow users to manage all certificates
1 = Allow users to manage user certificates
2 = Disallow users from managing certificates

• Chrome (Windows) since version 132

A list of TLS certificates that should be trusted by Samsung Browser for server authentication.
Certificates should be base64-encoded.

Windows (Windows clients):

Software\Policies\Samsung\Internet\CACertificates\1 = "MIICCTCCAY6gAwIBAgINAgPluILrIPglJ209ZjAKBggqhkjOPQQDAzBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjMwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAwMDAwWjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjMwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQfTzOHMymKoYTey8chWEGJ6ladK0uFxh1MJ7x/JlFyb+Kf1qPKzEUURout736GjOyxfi//qXGdGIRFBEFVbivqJn+7kAHjSxm65FSWRQmx1WyRRK2EE46ajA2ADDL24CejQjBAMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTB8Sa6oC2uhYHP0/EqEr24Cmf9vDAKBggqhkjOPQQDAwNpADBmAjEA9uEglRR7VKOQFhG/hMjqb2sXnh5GmCCbn9MN2azTL818+FsuVbu/3ZL3pAzcMeGiAjEA/JdmZuVDFhOD3cffL74UOO0BzrEXGhF16b0DjyZ+hOXJYKaV11RZt+cRLInUue4X"

• Chrome (Windows) since version 132

A list of TLS certificates that should be trusted by Samsung Browser for server authentication, with constraints added outside the certificate. If no constraint of a certain type is present, then any name of that type is allowed.
Certificates should be base64-encoded. At least one constraint must be specified for each certificate.

Windows (Windows clients):

Software\Policies\Samsung\Internet\CACertificatesWithConstraints = [ { "certificate": "MIICCTCCAY6gAwIBAgINAgPluILrIPglJ209ZjAKBggqhkjOPQQDAzBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjMwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAwMDAwWjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjMwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQfTzOHMymKoYTey8chWEGJ6ladK0uFxh1MJ7x/JlFyb+Kf1qPKzEUURout736GjOyxfi//qXGdGIRFBEFVbivqJn+7kAHjSxm65FSWRQmx1WyRRK2EE46ajA2ADDL24CejQjBAMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTB8Sa6oC2uhYHP0/EqEr24Cmf9vDAKBggqhkjOPQQDAwNpADBmAjEA9uEglRR7VKOQFhG/hMjqb2sXnh5GmCCbn9MN2azTL818+FsuVbu/3ZL3pAzcMeGiAjEA/JdmZuVDFhOD3cffL74UOO0BzrEXGhF16b0DjyZ+hOXJYKaV11RZt+cRLInUue4X", "constraints": { "permitted_cidrs": [ "10.1.1.0/24" ], "permitted_dns_names": [ "example.org" ] } } ]

• Chrome (Windows) since version 132

A list of certificate public keys that should be distrusted by Samsung Browser for TLS server
authentication.

The policy value is a list of base64-encoded X.509 certificates. Any
certificate with a matching SPKI (SubjectPublicKeyInfo) will be distrusted.

Windows (Windows clients):

Software\Policies\Samsung\Internet\CADistrustedCertificates\1 = "MIIB/TCCAaOgAwIBAgIUQthnWVsd1jWpUCNBf/uILjXC+t4wCgYIKoZIzj0EAwIwVDELMAkGA1UEBhMCVVMxETAPBgNVBAgMCFZpcmdpbmlhMQ8wDQYDVQQHDAZSZXN0b24xITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yMzEyMDcxNjE5NTVaFw0yMzEyMjExNjE5NTVaMFQxCzAJBgNVBAYTAlVTMREwDwYDVQQIDAhWaXJnaW5pYTEPMA0GA1UEBwwGUmVzdG9uMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQ9Akav/KB0aVA9FM1QK4J1CEHn5rFOyY/nxcr5HG3+Fom0Kwu5zTR/kz9eOYgtG/1NmCzbiEKaULDfzA8V9aJ7o1MwUTAdBgNVHQ4EFgQUq37bLKiuw8Y/G+rurMf46hw7EekwHwYDVR0jBBgwFoAUq37bLKiuw8Y/G+rurMf46hw7EekwDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNIADBFAiEA/JhtLSgtVOcXkgFJ9V5Vb6lhGdiKQFfzO9wTxPeCxCECIFePYPucys2n/r9MOBMHiX/8068ssv+uceqokzUg0mAb"

• Chrome (Windows) since version 132

A list of certificates that are not trusted or distrusted in Samsung Browser
but can be used as hints for path-building. Certificates should be base64-encoded.

Windows (Windows clients):

Software\Policies\Samsung\Internet\CAHintCertificates\1 = "MIIFljCCA36gAwIBAgINAgO8U1lrNMcY9QFQZjANBgkqhkiG9w0BAQsFADBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjEwHhcNMjAwODEzMDAwMDQyWhcNMjcwOTMwMDAwMDQyWjBGMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzETMBEGA1UEAxMKR1RTIENBIDFDMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAPWI3+dijB43+DdCkH9sh9D7ZYIl/ejLa6T/belaI+KZ9hzpkgOZE3wJCor6QtZeViSqejOEH9Hpabu5dOxXTGZok3c3VVP+ORBNtzS7XyV3NzsXlOo85Z3VvMO0Q+sup0fvsEQRY9i0QYXdQTBIkxu/t/bgRQIh4JZCF8/ZK2VWNAcmBA2o/X3KLu/qSHw3TT8An4Pf73WELnlXXPxXbhqW//yMmqaZviXZf5YsBvcRKgKAgOtjGDxQSYflispfGStZloEAoPtR28p3CwvJlk/vcEnHXG0g/Zm0tOLKLnf9LdwLtmsTDIwZKxeWmLnwi/agJ7u2441Rj72ux5uxiZ0CAwEAAaOCAYAwggF8MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQUinR/r4XN7pXNPZzQ4kYU83E1HScwHwYDVR0jBBgwFoAU5K8rJnEaK0gnhS9SZizv8IkTcT4waAYIKwYBBQUHAQEEXDBaMCYGCCsGAQUFBzABhhpodHRwOi8vb2NzcC5wa2kuZ29vZy9ndHNyMTAwBggrBgEFBQcwAoYkaHR0cDovL3BraS5nb29nL3JlcG8vY2VydHMvZ3RzcjEuZGVyMDQGA1UdHwQtMCswKaAnoCWGI2h0dHA6Ly9jcmwucGtpLmdvb2cvZ3RzcjEvZ3RzcjEuY3JsMFcGA1UdIARQME4wOAYKKwYBBAHWeQIFAzAqMCgGCCsGAQUFBwIBFhxodHRwczovL3BraS5nb29nL3JlcG9zaXRvcnkvMAgGBmeBDAECATAIBgZngQwBAgIwDQYJKoZIhvcNAQELBQADggIBAIl9rCBcDDy+mqhXlRu0rvqrpXJxtDaV/d9AEQNMwkYUuxQkq/BQcSLbrcRuf8/xam/IgxvYzolfh2yHuKkMo5uhYpSTld9brmYZCwKWnvy15xBpPnrLRklfRuFBsdeYTWU0AIAaP0+fbH9JAIFTQaSSIYKCGvGjRFsqUBITTcFTNvNCCK9U+o53UxtkOCcXCb1YyRt8OS1b887U7ZfbFAO/CVMkH8IMBHmYJvJh8VNS/UKMG2YrPxWhu//2m+OBmgEGcYk1KCTd4b3rGS3hSMs9WYNRtHTGnXzGsYZbr8w0xNPM1IERlQCh9BIiAfq0g3GvjLeMcySsN1PCAJA/Ef5c7TaUEDu9Ka7ixzpiO2xj2YC/WXGsYye5TBeg2vZzFb8q3o/zpWwygTMD0IZRcZk0upONXbVRWPeyk+gB9lm+cZv9TSjOz23HFtz30dZGm6fKa+l3D/2gthsjgx0QGtkJAITgRNOidSOzNIb2ILCkXhAd4FJGAJ2xDx8hcFH1mt0G/FX0Kw4zd8NLQsLxdxP8c4CU6x+7Nz/OAipmsHMdMqUybDKwjuDEI/9bfU1lcKwrmz3O2+BtjjKAvpafkmO8l7tdufThcV4q5O8DIrGKZTqPwJNl1IXNDw9bg1kWRxYtnCQ6yICmJhSFm/Y3m6xv+cXDBlHz4n/FsRC6UfTd"

• Chrome (Windows) since version 131

If enabled(or not set), user-added TLS certificates from platform trust stores will be used in path-building for TLS server authentication.

If disabled, user-added TLS certificates from platform trust stores will not be used in path-building for TLS server authentication.

true = Import user-added TLS server certificates from platform trust stores.
false = Do not import user-added TLS server certificates from platform trust stores.

• Chrome (Windows) since version 15

Setting the policy lets you make a list of URL patterns that specify sites for which Samsung Browser can automatically select a client certificate. The value is an array of stringified JSON dictionaries, each with the form { "pattern": "$URL_PATTERN", "filter" : $FILTER }, where $URL_PATTERN is a content setting pattern. $FILTER restricts the client certificates the browser automatically selects from. Independent of the filter, only certificates that match the server's certificate request are selected.

Examples for the usage of the $FILTER section:

* When $FILTER is set to { "ISSUER": { "CN": "$ISSUER_CN" } }, only client certificates issued by a certificate with the CommonName $ISSUER_CN are selected.

* When $FILTER contains both the "ISSUER" and the "SUBJECT" sections, only client certificates that satisfy both conditions are selected.

* When $FILTER contains a "SUBJECT" section with the "O" value, a certificate needs at least one organization matching the specified value to be selected.

* When $FILTER contains a "SUBJECT" section with a "OU" value, a certificate needs at least one organizational unit matching the specified value to be selected.

* When $FILTER is set to {}, the selection of client certificates is not additionally restricted. Note that filters provided by the web server still apply.

Leaving the policy unset means there's no autoselection for any site.

Windows (Windows clients):

Software\Policies\Samsung\Internet\AutoSelectCertificateForUrls\1 = "{"pattern":"https://www.example.com","filter":{"ISSUER":{"CN":"certificate issuer name", "L": "certificate issuer location", "O": "certificate issuer org", "OU": "certificate issuer org unit"}, "SUBJECT":{"CN":"certificate subject name", "L": "certificate subject location", "O": "certificate subject org", "OU": "certificate subject org unit"}}}"

• Chrome (Windows) since version 124

For security reasons, the
requestFullscreen() web API
requires a prior user gesture ("transient activation") to be called or will
otherwise fail. Users' personal settings may allow certain origins to call
this API without a prior user gesture.

This policy supersedes users' personal settings and allows matching origins to
call the API without a prior user gesture.

Wildcards, *, are allowed.

Origins matching both blocked and allowed policy patterns will be blocked.
Origins not specified by policy nor user settings will require a prior user
gesture to call this API.

Windows (Windows clients):

Software\Policies\Samsung\Internet\AutomaticFullscreenAllowedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\AutomaticFullscreenAllowedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 124

For security reasons, the
requestFullscreen() web API
requires a prior user gesture ("transient activation") to be called or will
otherwise fail. Users' personal settings may allow certain origins to call
this API without a prior user gesture.

This policy supersedes users' personal settings and blocks matching origins
from calling the API without a prior user gesture.

Wildcards, *, are allowed.

Origins matching both blocked and allowed policy patterns will be blocked.
Origins not specified by policy nor user settings will require a prior user
gesture to call this API.

Windows (Windows clients):

Software\Policies\Samsung\Internet\AutomaticFullscreenBlockedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\AutomaticFullscreenBlockedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 103

Setting the policy lets you set a list of URL patterns that specify sites that can use the clipboard site permission. This does not include all clipboard operations on origins matching the patterns. For instance, users will still be able to paste using keyboard shortcuts as this isn't gated by the clipboard site permission.

Leaving the policy unset means DefaultClipboardSetting applies for all sites, if it's set. If not, the user's personal setting applies.

For detailed information on valid URL patterns, see the documentation for URL patterns. Wildcards, *, are allowed.

Windows (Windows clients):

Software\Policies\Samsung\Internet\ClipboardAllowedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\ClipboardAllowedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 103

Setting the policy lets you set a list of URL patterns that specify sites that can't use the clipboard site permission. This does not include all clipboard operations on origins matching the patterns. For instance, users will still be able to paste using keyboard shortcuts as this isn't gated by the clipboard site permission.

Leaving the policy unset means DefaultClipboardSetting applies for all sites, if it's set. If not, the user's personal setting applies.

Wildcards, *, are allowed.

Windows (Windows clients):

Software\Policies\Samsung\Internet\ClipboardBlockedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\ClipboardBlockedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 11

Allows you to set a list of url patterns that specify sites which are allowed to set cookies.

URL patterns may be a single URL indicating that the site may use cookies on all top-level sites.

Patterns may also be two URLs delimited by a comma. The first specifies the site that should be allowed to use cookies. The second specifies the top-level site that the first value should be applied on.

If you use a pair of URLs, the first value in the pair supports * but the second value does not. Using * for the first value indicates that all sites may use cookies when the second URL is the top-level site.

If this policy is left not set the global default value will be used for all sites either from the DefaultCookiesSetting or BlockThirdPartyCookies policies if they are set, or the user's personal configuration otherwise.

See also policies CookiesBlockedForUrls and CookiesSessionOnlyForUrls. Note that there must be no conflicting URL patterns between these three policies - it is unspecified which policy takes precedence.

Windows (Windows clients):

Software\Policies\Samsung\Internet\CookiesAllowedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\CookiesAllowedForUrls\2 = "[*.]example.edu" Software\Policies\Samsung\Internet\CookiesAllowedForUrls\3 = "https://www.example.com/,https://www.toplevel.com/" Software\Policies\Samsung\Internet\CookiesAllowedForUrls\4 = "*,https://www.toplevel.com/"

• Chrome (Windows) since version 11

Setting the policy lets you make a list of URL patterns that specify sites that can't set cookies.

Leaving the policy unset results in the use of DefaultCookiesSetting for all sites, if it's set. If not, the user's personal setting applies.

While no specific policy takes precedence, see CookiesAllowedForUrls and CookiesSessionOnlyForUrls. URL patterns among these 3 policies must not conflict.

For detailed information on valid URL patterns, see the documentation for URL patterns. * is not an accepted value for this policy.

Windows (Windows clients):

Software\Policies\Samsung\Internet\CookiesBlockedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\CookiesBlockedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 11

Unless the RestoreOnStartup policy is set to permanently restore URLs from previous sessions, then setting CookiesSessionOnlyForUrls lets you make a list of URL patterns that specify sites that can and can't set cookies for one session.

Leaving the policy unset results in the use of DefaultCookiesSetting for all sites, if it's set. If not, the user's personal setting applies. URLs not covered by the patterns specified also result in the use of defaults.

While no specific policy takes precedence, see CookiesBlockedForUrls and CookiesAllowedForUrls. URL patterns among these 3 policies must not conflict.

* is not an accepted value for this policy.

Windows (Windows clients):

Software\Policies\Samsung\Internet\CookiesSessionOnlyForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\CookiesSessionOnlyForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 120

This policy enables Data URL support for SVGUseElement, which will be disabled
by default.
If this policy is set to Enabled, Data URLs will continue to work in SVGUseElement.
If this policy is set to Disabled or not set, Data URLs won't work in SVGUseElement.

true = Enable Data URL support in SVGUseElement.
false = Disable Data URL support in SVGUseElement.

• Chrome (Windows) since version 103

Setting the policy to 2 blocks sites from using the clipboard site permission. Setting the policy to 3 or leaving it unset lets the user change the setting and decide if the clipboard APIs are available when a site wants to use one.

This policy can be overridden for specific URL patterns using the ClipboardAllowedForUrls and ClipboardBlockedForUrls policies.

This policy only affects clipboard operations controlled by the clipboard site permission, and does not affect sanitized clipboard writes or trusted copy and paste operations.

2 = Do not allow any site to use the clipboard site permission
3 = Allow sites to ask the user to grant the clipboard site permission

• Chrome (Windows) since version 86

Setting the policy to 3 lets websites ask for read access to files and directories in the host operating system's file system via the File System API. Setting the policy to 2 denies access.

Leaving it unset lets websites ask for access, but users can change this setting.

2 = Do not allow any site to request read access to files and directories via the File System API
3 = Allow sites to ask the user to grant read access to files and directories via the File System API

• Chrome (Windows) since version 86

Setting the policy to 3 lets websites ask for write access to files and directories in the host operating system's file system. Setting the policy to 2 denies access.

Leaving it unset lets websites ask for access, but users can change this setting.

2 = Do not allow any site to request write access to files and directories
3 = Allow sites to ask the user to grant write access to files and directories

• Chrome (Windows) since version 146

Allows you to set whether websites are allowed to use the Idle Detection API.

When this policy is set to 1 - AllowIdleDetection, websites can use the API without asking the user for permission.

When this policy is set to 2 - BlockIdleDetection, websites can't use the API, regardless of the user's permission.

When this policy is set to 3 - AskIdleDetection or not set, websites can't use the API without the user's permission.

1 = Allow sites to detect idle state without asking the user
2 = Do not allow any site to detect the user's idle state
3 = Ask every time a site wants to detect the user's idle state

• Chrome (Windows) since version 79

Allows you to set whether users can add exceptions to allow mixed content for specific sites.

This policy can be overridden for specific URL patterns using the 'InsecureContentAllowedForUrls' and 'InsecureContentBlockedForUrls' policies.

If this policy is left not set, users will be allowed to add exceptions to allow blockable mixed content and disable autoupgrades for optionally blockable mixed content.

2 = Do not allow any site to load mixed content
3 = Allow users to add exceptions to allow mixed content

• Chrome (Windows) since version 93

Allows you to set whether Samsung Browser will run the v8 JavaScript engine with JIT (Just In Time) compiler enabled or not.

Disabling the JavaScript JIT will mean that Samsung Browser may render web content more slowly, and may also disable parts of JavaScript including WebAssembly. Disabling the JavaScript JIT may allow Samsung Browser to render web content in a more secure configuration.

This policy can be overridden for specific URL patterns using the JavaScriptJitAllowedForSites and JavaScriptJitBlockedForSites policies.

If this policy is left not set, JavaScript JIT is enabled.

1 = Allow any site to run JavaScript JIT
2 = Do not allow any site to run JavaScript JIT

• Chrome (Windows) since version 133

Allows you to set whether Samsung Browser
will run the v8 JavaScript engine with more advanced JavaScript optimizations enabled.

Disabling JavaScript optimizations (by setting this policy's value to 2) will
mean that Samsung Browser may render web
content more slowly.

This policy can be overridden for specific URL patterns using the JavaScriptOptimizerAllowedForSites and JavaScriptOptimizerBlockedForSites policies.

If this policy is left not set, JavaScript optimizations are enabled.

1 = Enable advanced JavaScript optimizations on all sites
2 = Disable advanced JavaScript optimizations on all sites

• Chrome (Windows) since version 86

Setting the policy to 3 lets websites ask for access to serial ports. Setting the policy to 2 denies access to serial ports.

Leaving it unset lets websites ask for access, but users can change this setting.

2 = Do not allow any site to request access to serial ports via the Serial API
3 = Allow sites to ask the user to grant access to a serial port

• Chrome (Windows) since version 50

Setting the policy to 3 lets websites ask for access to nearby Bluetooth devices. Setting the policy to 2 denies access to nearby Bluetooth devices.

Leaving the policy unset lets sites ask for access, but users can change this setting.

2 = Do not allow any site to request access to Bluetooth devices via the Web Bluetooth API
3 = Allow sites to ask the user to grant access to a nearby Bluetooth device

• Chrome (Windows) since version 100

Setting the policy to 3 lets websites ask for access to HID devices. Setting the policy to 2 denies access to HID devices.

Leaving it unset lets websites ask for access, but users can change this setting.

This policy can be overridden for specific url patterns using the WebHidAskForUrls and WebHidBlockedForUrls policies.

2 = Do not allow any site to request access to HID devices via the WebHID API
3 = Allow sites to ask the user to grant access to a HID device

• Chrome (Windows) since version 86

Setting the policy lets you list the URL patterns that specify which sites can ask users to grant them read access to files or directories in the host operating system's file system via the File System API.

Leaving the policy unset means DefaultFileSystemReadGuardSetting applies for all sites, if it's set. If not, users' personal settings apply.

URL patterns must not conflict with FileSystemReadBlockedForUrls. Neither policy takes precedence if a URL matches with both.

* is not an accepted value for this policy.

Windows (Windows clients):

Software\Policies\Samsung\Internet\FileSystemReadAskForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\FileSystemReadAskForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 86

Setting the policy lets you list the URL patterns that specify which sites can't ask users to grant them read access to files or directories in the host operating system's file system via the File System API.

Leaving the policy unset means DefaultFileSystemReadGuardSetting applies for all sites, if it's set. If not, users' personal settings apply.

URL patterns can't conflict with FileSystemReadAskForUrls. Neither policy takes precedence if a URL matches with both.

For detailed information on valid URL patterns, see the documentation for URL patterns. * is not an accepted value for this policy.

Windows (Windows clients):

Software\Policies\Samsung\Internet\FileSystemReadBlockedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\FileSystemReadBlockedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 86

Setting the policy lets you list the URL patterns that specify which sites can ask users to grant them write access to files or directories in the host operating system's file system.

Leaving the policy unset means DefaultFileSystemWriteGuardSetting applies for all sites, if it's set. If not, users' personal settings apply.

URL patterns must not conflict with FileSystemWriteBlockedForUrls. Neither policy takes precedence if a URL matches with both.

Windows (Windows clients):

Software\Policies\Samsung\Internet\FileSystemWriteAskForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\FileSystemWriteAskForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 86

Setting the policy lets you list the URL patterns that specify which sites can't ask users to grant them write access to files or directories in the host operating system's file system.

Leaving the policy unset means DefaultFileSystemWriteGuardSetting applies for all sites, if it's set. If not, users' personal settings apply.

URL patterns can't conflict with FileSystemWriteAskForUrls. Neither policy takes precedence if a URL matches with both.

* is not an accepted value for this policy.

Windows (Windows clients):

Software\Policies\Samsung\Internet\FileSystemWriteBlockedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\FileSystemWriteBlockedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 144

Setting the policy lets you set a list of URL patterns that specify sites that are not allowed to access the user's geolocation, and are also prevented from requesting user permission to do so.

Leaving the policy unset means DefaultGeolocationSetting applies for all sites, if it's set. If not, the user's personal setting applies.

Wildcards, *, are allowed.

Windows (Windows clients):

Software\Policies\Samsung\Internet\GeolocationBlockedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\GeolocationBlockedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 146

Allows you to set a list of URL patterns that specify the sites that are allowed to use the Idle Detection API without asking the user. Blocklist entries have higher priority than allowlist entries, which in turn have higher priority than the configured default value.

Wildcards, *, are allowed. This policy only matches based on origin, so any path in the URL pattern is ignored.

If this policy is not set, the global default value will be used for all sites, which is configured by the DefaultIdleDetectionSetting (Default idle detection setting) policy, if set, or by the user's personal configuration otherwise.

Windows (Windows clients):

Software\Policies\Samsung\Internet\IdleDetectionAllowedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\IdleDetectionAllowedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 146

Allows you to set a list of URL patterns that specify the sites that are not allowed to use the Idle Detection API.

Wildcards, *, are allowed. This policy only matches based on origin, so any path in the URL pattern is ignored.

If this policy is not set, the global default value will be used for all sites, which is configured by the DefaultIdleDetectionSetting (Default idle detection setting) policy, if set, or by the user's personal configuration otherwise.

Windows (Windows clients):

Software\Policies\Samsung\Internet\IdleDetectionBlockedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\IdleDetectionBlockedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 11

Setting the policy lets you set a list of URL patterns that specify sites that may display images.

Leaving the policy unset means DefaultImagesSetting applies for all sites, if it's set. If not, the user's personal setting applies.

For detailed information on valid URL patterns, see the documentation for URL patterns. Wildcards, *, are allowed.

Windows (Windows clients):

Software\Policies\Samsung\Internet\ImagesAllowedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\ImagesAllowedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 11

Setting the policy lets you set a list of URL patterns that specify sites that can't display images.

Leaving the policy unset means DefaultImagesSetting applies for all sites, if it's set. If not, the user's personal setting applies.

Windows (Windows clients):

Software\Policies\Samsung\Internet\ImagesBlockedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\ImagesBlockedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 79

Allows you to set a list of url patterns that specify sites which are allowed to display blockable (i.e. active) mixed content (i.e. HTTP content on HTTPS sites) and for which optionally blockable mixed content upgrades will be disabled.

If this policy is left not set blockable mixed content will be blocked and optionally blockable mixed content will be upgraded, and users will be allowed to set exceptions to allow it for specific sites.

Windows (Windows clients):

Software\Policies\Samsung\Internet\InsecureContentAllowedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\InsecureContentAllowedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 79

Allows you to set a list of url patterns that specify sites which are not allowed to display blockable (i.e. active) mixed content (i.e. HTTP content on HTTPS sites), and for which optionally blockable (i.e. passive) mixed content will be upgraded.

If this policy is left not set blockable mixed content will be blocked and optionally blockable mixed content will be upgraded, but users will be allowed to set exceptions to allow it for specific sites.

Wildcards, *, are allowed.

Windows (Windows clients):

Software\Policies\Samsung\Internet\InsecureContentBlockedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\InsecureContentBlockedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 11

Setting the policy lets you set a list of URL patterns that specify the sites that can run JavaScript.

Leaving the policy unset means DefaultJavaScriptSetting applies for all sites, if it's set. If not, the user's personal setting applies.

For detailed information on valid URL patterns, see the documentation for URL patterns. Wildcards, *, are allowed.

Windows (Windows clients):

Software\Policies\Samsung\Internet\JavaScriptAllowedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\JavaScriptAllowedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 93

Allows you to set a list of site url patterns that specify sites which are allowed to run JavaScript with JIT (Just In Time) compiler enabled.

Wildcards, *, are allowed.

JavaScript JIT policy exceptions will only be enforced at a site granularity (eTLD+1). A policy set for only subdomain.site.com will not correctly apply to site.com or subdomain.site.com since they both resolve to the same eTLD+1 (site.com) for which there is no policy. In this case, policy must be set on site.com to apply correctly for both site.com and subdomain.site.com.

This policy applies on a frame-by-frame basis and not based on top level origin url alone, so e.g. if site-one.com is listed in the JavaScriptJitAllowedForSites policy but site-one.com loads a frame containing site-two.com then site-one.com will have JavaScript JIT enabled, but site-two.com will use the policy from DefaultJavaScriptJitSetting, if set, or default to JavaScript JIT enabled.

If this policy is not set for a site then the policy from DefaultJavaScriptJitSetting applies to the site, if set, otherwise Javascript JIT is enabled for the site.

Windows (Windows clients):

Software\Policies\Samsung\Internet\JavaScriptJitAllowedForSites\1 = "[*.]example.edu"

• Chrome (Windows) since version 93

Allows you to set a list of site URL patterns that specify sites which are not allowed to run JavaScript JIT (Just In Time) compiler enabled.

Disabling the JavaScript JIT will mean that Samsung Browser may render web content more slowly, and may also disable parts of JavaScript including WebAssembly. Disabling the JavaScript JIT may allow Samsung Browser to render web content in a more secure configuration.

For detailed information on valid URL patterns, see the documentation for URL patterns. Wildcards, *, are allowed.

JavaScript JIT policy exceptions will only be enforced at a site granularity (eTLD+1). A policy set for only subdomain.site.com will not correctly apply to site.com or subdomain.site.com since they both resolve to the same eTLD+1 (site.com) for which there is no policy. In this case, policy must be set on site.com to apply correctly for both site.com and subdomain.site.com.

This policy applies on a frame-by-frame basis and not based on top level origin URL alone, so e.g. if site-one.com is listed in the JavaScriptJitBlockedForSites policy but site-one.com loads a frame containing site-two.com then site-one.com will have JavaScript JIT disabled, but site-two.com will use the policy from DefaultJavaScriptJitSetting, if set, or default to JavaScript JIT enabled.

If this policy is not set for a site then the policy from DefaultJavaScriptJitSetting applies to the site, if set, otherwise JavaScript JIT is enabled for the site.

Windows (Windows clients):

Software\Policies\Samsung\Internet\JavaScriptJitBlockedForSites\1 = "[*.]example.edu"

• Chrome (Windows) since version 133

Allows you to set a list of site url patterns that specify sites for which
advanced JavaScript optimizations are enabled.

Wildcards, *, are allowed.

JavaScript optimization policy exceptions will only be enforced at a site
granularity (eTLD+1). A policy set for only subdomain.site.com will not
correctly apply to site.com or subdomain.site.com since they both resolve to
the same eTLD+1 (site.com) for which there is no policy. In this case, policy
must be set on site.com to apply correctly for both site.com and
subdomain.site.com.

This policy applies on a frame-by-frame basis and not based on top level
origin url alone, so e.g. if site-one.com is listed in the JavaScriptOptimizerAllowedForSites policy but site-one.com loads a frame containing site-two.com then site-one.com will have JavaScript optimizations
enabled, but site-two.com will use the policy from DefaultJavaScriptOptimizerSetting, if set, or default to JavaScript
optimizations enabled. Blocklist entries have higher priority than allowlist
entries, which in turn have higher priority than the configured default value.

If this policy is not set for a site then the policy from DefaultJavaScriptOptimizerSetting applies to the site, if set, otherwise
Javascript optimization is enabled for the site.

Windows (Windows clients):

Software\Policies\Samsung\Internet\JavaScriptOptimizerAllowedForSites\1 = "[*.]example.edu"

• Chrome (Windows) since version 133

Allows you to set a list of site url patterns that specify sites for which
advanced JavaScript optimizations are disabled.

Disabling JavaScript optimizations will mean that Samsung Browser may render web content more slowly.

Wildcards, *, are allowed.

JavaScript optimization policy exceptions will only be enforced at a site
granularity (eTLD+1). A policy set for only subdomain.site.com will not
correctly apply to site.com or subdomain.site.com since they both resolve to
the same eTLD+1 (site.com) for which there is no policy. In this case, policy
must be set on site.com to apply correctly for both site.com and
subdomain.site.com.

This policy applies on a frame-by-frame basis and not based on top level
origin url alone, so e.g. if site-one.com is listed in the JavaScriptOptimizerBlockedForSites policy but site-one.com loads a frame
containing site-two.com then site-one.com will have JavaScript optimizations
disabled, but site-two.com will use the policy from DefaultJavaScriptOptimizerSetting, if set, or default to JavaScript
optimizations enabled. Blocklist entries have higher priority than allowlist
entries, which in turn have higher priority than the configured default value.

If this policy is not set for a site then the policy from DefaultJavaScriptOptimizerSetting applies to the site, if set, otherwise
JavaScript optimization is enabled for the site.

Windows (Windows clients):

Software\Policies\Samsung\Internet\JavaScriptOptimizerBlockedForSites\1 = "[*.]example.edu"

• Chrome (Windows) since version 103

Sets a list of site url patterns that specify sites which will automatically grant the local fonts permission. This will extend the ability of sites to see information about local fonts.

If this policy is not set for a site then the policy from DefaultLocalFontsSetting applies to the site, if set, otherwise the permission will follow the browser's defaults and allow users to choose this permission per site.

Windows (Windows clients):

Software\Policies\Samsung\Internet\LocalFontsAllowedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\LocalFontsAllowedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 103

Sets a list of site url patterns that specify sites which will automatically deny the local fonts permission. This will limit the ability of sites to see information about local fonts.

Wildcards, *, are allowed. This policy only matches based on origin, so any path in the URL pattern is ignored.

If this policy is not set for a site then the policy from DefaultLocalFontsSetting applies to the site, if set, otherwise the permission will follow the browser's defaults and allow users to choose this permission per site.

Windows (Windows clients):

Software\Policies\Samsung\Internet\LocalFontsBlockedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\LocalFontsBlockedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 16

Setting the policy lets you set a list of URL patterns that specify the sites that can display notifications.

Leaving the policy unset means DefaultNotificationsSetting applies for all sites, if it's set. If not, the user's personal setting applies.

Wildcards, *, are allowed.

Windows (Windows clients):

Software\Policies\Samsung\Internet\NotificationsAllowedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\NotificationsAllowedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 16

Setting the policy lets you set a list of URL patterns that specify the sites that can't display notifications.

Leaving the policy unset means DefaultNotificationsSetting applies for all sites, if it's set. If not, the user's personal setting applies.

For detailed information on valid URL patterns, see the documentation for URL patterns. Wildcards, *, are allowed.

Windows (Windows clients):

Software\Policies\Samsung\Internet\NotificationsBlockedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\NotificationsBlockedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 110

Setting this policy allows the domains listed to access file:// URLs in the PDF Viewer.
Adding to the policy allows the domain to access file:// URLs in the PDF Viewer.
Removing from the policy disallows the domain from accessing file:// URLs in the PDF Viewer.
Leaving the policy unset disallows all domains from accessing file:// URLs in the PDF Viewer.

Windows (Windows clients):

Software\Policies\Samsung\Internet\PdfLocalFileAccessAllowedForDomains\1 = "example.com" Software\Policies\Samsung\Internet\PdfLocalFileAccessAllowedForDomains\2 = "google.com"

• Chrome (Windows) since version 11

Setting the policy lets you set a list of URL patterns that specify the sites that can open pop-ups.

Leaving the policy unset means DefaultPopupsSetting applies for all sites, if it's set. If not, the user's personal setting applies.

Wildcards, *, are allowed.

Windows (Windows clients):

Software\Policies\Samsung\Internet\PopupsAllowedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\PopupsAllowedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 11

Setting the policy lets you set a list of URL patterns that specify the sites that can't open pop-ups.

Leaving the policy unset means DefaultPopupsSetting applies for all sites, if it's set. If not, the user's personal setting applies.

For detailed information on valid URL patterns, see the documentation for URL patterns. Wildcards, *, are allowed.

Windows (Windows clients):

Software\Policies\Samsung\Internet\PopupsBlockedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\PopupsBlockedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 144

Setting the policy lets you set a list of URL patterns that specify sites that are allowed to access the user's high accuracy geolocation without first having to request the user's permission to do so.

Leaving the policy unset means DefaultGeolocationSetting applies for all sites, if it's set. If not, the user's personal setting applies.

Wildcards, *, are allowed.

Windows (Windows clients):

Software\Policies\Samsung\Internet\PreciseGeolocationAllowedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\PreciseGeolocationAllowedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 37

Setting the policy (as recommended only) lets you register a list of protocol handlers, which merge with the ones that the user registers, putting both sets in use. Set the property "protocol" to the scheme, such as "mailto", and set the property "URL" to the URL pattern of the application that handles the scheme specified in the "protocol" field. The pattern can include a "%s" placeholder, which the handled URL replaces.

Users can't remove a protocol handler registered by policy. However, by installing a new default handler, they can change the protocol handlers installed by policy.

Windows (Windows clients):

Software\Policies\Samsung\Internet\Recommended\RegisteredProtocolHandlers = [ { "default": true, "protocol": "mailto", "url": "https://mail.google.com/mail/?extsrc=mailto&url=%s" } ]

• Chrome (Windows) since version 88

Setting the policy lets you set a list of URL patterns that specify the sites that can access sensors like motion and light sensors.

Leaving the policy unset means DefaultSensorsSetting applies for all sites, if it's set. If not, the user's personal setting applies.

If the same URL pattern exists in both this policy and the SensorsBlockedForUrls policy, the latter is prioritized and access to motion or light sensors will be blocked.

Wildcards, *, are allowed.

Windows (Windows clients):

Software\Policies\Samsung\Internet\SensorsAllowedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\SensorsAllowedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 88

Setting the policy lets you set a list of URL patterns that specify the sites that can't access sensors like motion and light sensors.

Leaving the policy unset means DefaultSensorsSetting applies for all sites, if it's set. If not, the user's personal setting applies.

If the same URL pattern exists in both this policy and the SensorsAllowedForUrls policy, this policy is prioritized and access to motion or light sensors will be blocked.

Wildcards, *, are allowed.

Windows (Windows clients):

Software\Policies\Samsung\Internet\SensorsBlockedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\SensorsBlockedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 94

Setting the policy allows you to list sites which are automatically granted permission to access all available serial ports.

The URLs must be valid, otherwise the policy is ignored. Only the origin (scheme, host and port) of the URL is considered.

This policy overrides DefaultSerialGuardSetting, SerialAskForUrls, SerialBlockedForUrls and the user's preferences.

Windows (Windows clients):

Software\Policies\Samsung\Internet\SerialAllowAllPortsForUrls\1 = "https://www.example.com"

• Chrome (Windows) since version 94

Setting the policy allows you to list sites which are automatically granted permission to access USB serial devices with vendor and product IDs matching the vendor_id and product_id fields. Omitting the product_id field allows the given sites permission to access devices with a vendor ID matching the vendor_id field and any product ID.

The URLs must be valid, otherwise the policy is ignored. Only the origin (scheme, host and port) of the URL is considered.

This policy overrides DefaultSerialGuardSetting, SerialAskForUrls, SerialBlockedForUrls and the user's preferences.

This policy only affects access to USB devices through the Web Serial API. To grant access to USB devices through the WebUSB API see the WebUsbAllowDevicesForUrls policy.

Windows (Windows clients):

Software\Policies\Samsung\Internet\SerialAllowUsbDevicesForUrls = [ { "devices": [ { "product_id": 5678, "vendor_id": 1234 } ], "urls": [ "https://specific-device.example.com" ] }, { "devices": [ { "vendor_id": 1234 } ], "urls": [ "https://all-vendor-devices.example.com" ] } ]

• Chrome (Windows) since version 86

Setting the policy lets you list the URL patterns that specify which sites can ask users to grant them access to a serial port.

Leaving the policy unset means DefaultSerialGuardSetting applies for all sites, if it's set. If not, users' personal settings apply.

For URL patterns which do not match the policy SerialBlockedForUrls (if there is a match), DefaultSerialGuardSetting (if set), or the users' personal settings take precedence, in that order.

If URL patterns conflict with SerialBlockedForUrls they will be ignored.

* is not an accepted value for this policy.

Windows (Windows clients):

Software\Policies\Samsung\Internet\SerialAskForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\SerialAskForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 86

Setting the policy lets you list the URL patterns that specify which sites can't ask users to grant them access to a serial port.

Leaving the policy unset means DefaultSerialGuardSetting applies for all sites, if it's set. If not, the user's personal setting applies.

For URL patterns which do not match the policy SerialAskForUrls (if there is a match), DefaultSerialGuardSetting (if set), or the users' personal settings take precedence, in that order.

If URL patterns conflict with SerialAskForUrls this policy will take precedence.

* is not an accepted value for this policy.

Windows (Windows clients):

Software\Policies\Samsung\Internet\SerialBlockedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\SerialBlockedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 100

Setting the policy allows you to list sites which are automatically granted permission to access all available devices.

The URLs must be valid, otherwise the policy is ignored. Only the origin (scheme, host and port) of the URL is considered.

This policy overrides DefaultWebHidGuardSetting, WebHidAskForUrls, WebHidBlockedForUrls and the user's preferences.

Windows (Windows clients):

Software\Policies\Samsung\Internet\WebHidAllowAllDevicesForUrls\1 = "https://google.com" Software\Policies\Samsung\Internet\WebHidAllowAllDevicesForUrls\2 = "https://chromium.org"

• Chrome (Windows) since version 100

Setting the policy lets you list the URLs that specify which sites are automatically granted permission to access a HID device with the given vendor and product IDs. Each item in the list requires both devices and urls fields for the item to be valid, otherwise the item is ignored. Each item in the devices field must have a vendor_id and may have a product_id field. Omitting the product_id field will create a policy matching any device with the specified vendor ID. An item which has a product_id field without a vendor_id field is invalid and is ignored.

Leaving the policy unset means DefaultWebHidGuardSetting applies, if it's set. If not, the user's personal setting applies.

URLs in this policy shouldn't conflict with those configured through WebHidBlockedForUrls. If they do, this policy takes precedence over WebHidBlockedForUrls.

Windows (Windows clients):

Software\Policies\Samsung\Internet\WebHidAllowDevicesForUrls = [ { "devices": [ { "product_id": 5678, "vendor_id": 1234 } ], "urls": [ "https://google.com", "https://chromium.org" ] } ]

• Chrome (Windows) since version 100

Setting the policy lets you list the URLs that specify which sites are automatically granted permission to access a HID device containing a top-level collection with the given HID usage. Each item in the list requires both usages and urls fields for the policy to be valid. Each item in the usages field must have a usage_page and may have a usage field. Omitting the usage field will create a policy matching any device containing a top-level collection with a usage from the specified usage page. An item which has a usage field without a usage_page field is invalid and is ignored.

Leaving the policy unset means DefaultWebHidGuardSetting applies, if it's set. If not, the user's personal setting applies.

URLs in this policy shouldn't conflict with those configured through WebHidBlockedForUrls. If they do, this policy takes precedence over WebHidBlockedForUrls.

Windows (Windows clients):

Software\Policies\Samsung\Internet\WebHidAllowDevicesWithHidUsagesForUrls = [ { "urls": [ "https://google.com", "https://chromium.org" ], "usages": [ { "usage": 5678, "usage_page": 1234 } ] } ]

• Chrome (Windows) since version 100

Setting the policy lets you list the URL patterns that specify which sites can ask users to grant them access to a HID device.

Leaving the policy unset means DefaultWebHidGuardSetting applies for all sites, if it's set. If not, users' personal settings apply.

For URL patterns which do not match the policy, the following take precedence, in this order:

* WebHidBlockedForUrls (if there is a match),

* DefaultWebHidGuardSetting (if set), or

* Users' personal settings.

URL patterns must not conflict with WebHidBlockedForUrls. Neither policy takes precedence if a URL matches with both.

* is not an accepted value for this policy.

Windows (Windows clients):

Software\Policies\Samsung\Internet\WebHidAskForUrls\1 = "https://google.com" Software\Policies\Samsung\Internet\WebHidAskForUrls\2 = "https://chromium.org"

• Chrome (Windows) since version 100

Setting the policy lets you list the URL patterns that specify which sites can't ask users to grant them access to a HID device.

Leaving the policy unset means DefaultWebHidGuardSetting applies for all sites, if it's set. If not, users' personal settings apply.

For URL patterns which do not match the policy, the following take precedence, in this order:

* WebHidAskForUrls (if there is a match),

* DefaultWebHidGuardSetting (if set), or

* Users' personal settings.

URL patterns can't conflict with WebHidAskForUrls. Neither policy takes precedence if a URL matches with both.

Windows (Windows clients):

Software\Policies\Samsung\Internet\WebHidBlockedForUrls\1 = "https://google.com" Software\Policies\Samsung\Internet\WebHidBlockedForUrls\2 = "https://chromium.org"

• Chrome (Windows) since version 74

Setting the policy lets you list the URL patterns that specify which sites are automatically granted permission to access a USB device with the given vendor and product IDs. Each item in the list requires both devices and urls fields for the policy to be valid. Each item in the devices field can have a vendor_id and product_id field. Omitting the vendor_id field will create a policy matching any device. Omitting the product_id field will create a policy matching any device with the given vendor ID. A policy which has a product_id field without a vendor_id field is invalid.

The USB permission model will grant the specified URL permission to access the USB device as a top-level origin. If embedded frames need to access USB devices, the 'usb' feature-policy header should be used to grant access. The URL must be valid, otherwise the policy is ignored.

Deprecated: The USB permission model used to support specifying both the requesting and embedding URLs. This is deprecated and only supported for backwards compatibility in this manner: if both a requesting and embedding URL is specified, then the embedding URL will be granted the permission as top-level origin and the requesting URL will be ignored entirely.

This policy overrides DefaultWebUsbGuardSetting, WebUsbAskForUrls, WebUsbBlockedForUrls and the user's preferences.

This policy only affects access to USB devices through the WebUSB API. To grant access to USB devices through the Web Serial API see the SerialAllowUsbDevicesForUrls policy.

Windows (Windows clients):

Software\Policies\Samsung\Internet\WebUsbAllowDevicesForUrls = [ { "devices": [ { "product_id": 5678, "vendor_id": 1234 } ], "urls": [ "https://google.com" ] } ]

• Chrome (Windows) since version 68

Setting the policy lets you list the URL patterns that specify which sites can ask users to grant them access to a USB device.

Leaving the policy unset means DefaultWebUsbGuardSetting applies for all sites, if it's set. If not, users' personal settings apply.

URL patterns must not conflict with WebUsbAskForUrls. Neither policy takes precedence if a URL matches with both.

For detailed information on valid URL patterns, see the documentation for URL patterns. * is not an accepted value for this policy.

Windows (Windows clients):

Software\Policies\Samsung\Internet\WebUsbAskForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\WebUsbAskForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 68

Setting the policy lets you list the URL patterns that specify which sites can't ask users to grant them access to a USB device.

Leaving the policy unset means DefaultWebUsbGuardSetting applies for all sites, if it's set. If not, the user's personal setting applies.

URL patterns can't conflict with WebUsbAskForUrls. Neither policy takes precedence if a URL matches with both.

Windows (Windows clients):

Software\Policies\Samsung\Internet\WebUsbBlockedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\WebUsbBlockedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 111

Allows you to set a list of site url patterns that specify sites which will automatically grant the window management permission. This will extend the ability of sites to see information about the device's screens and use that information to open and place windows or request fullscreen on specific screens.

Wildcards, *, are allowed. This policy only matches based on origin, so any path in the URL pattern is ignored.

If this policy is not set for a site then the policy from DefaultWindowManagementSetting applies to the site, if set, otherwise the permission will follow the browser's defaults and allow users to choose this permission per site.

This replaces the deprecated WindowPlacementAllowedForUrls policy.

Windows (Windows clients):

Software\Policies\Samsung\Internet\WindowManagementAllowedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\WindowManagementAllowedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 111

Allows you to set a list of site url patterns that specify sites which will automatically deny the window management permission. This will limit the ability of sites to see information about the device's screens and use that information to open and place windows or request fullscreen on specific screens.

Wildcards, *, are allowed. This policy only matches based on origin, so any path in the URL pattern is ignored.

If this policy is not set for a site then the policy from DefaultWindowManagementSetting applies to the site, if set, otherwise the permission will follow the browser's defaults and allow users to choose this permission per site.

This replaces the deprecated WindowPlacementBlockedForUrls policy.

Windows (Windows clients):

Software\Policies\Samsung\Internet\WindowManagementBlockedForUrls\1 = "https://www.example.com" Software\Policies\Samsung\Internet\WindowManagementBlockedForUrls\2 = "[*.]example.edu"

• Chrome (Windows) since version 146

This policy configures Samsung Browser to order its preferred encryption ciphers in TLS 1.3 to reflect a preference for algorithms that have been approved by a specific compliance regime.

Setting this policy does not guarantee that any specific algorithms will be negotiated.

This policy exists to allow server operators who wish to support clients with and without compliance requirements to differentiate between those clients, and only use certain non-default algorithms with increased cryptographic strength for those explicitly configured to prefer them.

Setting the policy to 'cnsa' configures Samsung Browser to prefer ciphers required for compliance with the Commercial National Security Algorithm Suite versions 1.0 and 2.0 (CNSA 1.0 and 2.0).

Not setting the policy, or setting it to 'default', configures Samsung Browser to use its default ciphers.

Setting this policy is not required for security. The default cryptography used by Samsung Browser is strong enough to withstand a brute force attack using the entire power of the Sun.

Setting this policy will cause Samsung Browser to be slower when accessing websites.

This policy only affects TLS 1.3 and QUIC; it does not affect earlier versions of TLS.

"cnsa" = Prefer ciphers satisfying the requirements of CNSA 1.0 and 2.0
"default" = Use Samsung Browser's default cipher order

• Chrome (Windows) since version 146

This policy configures Samsung Browser to order its preferred key agreement algorithms (supported groups) in TLS 1.3 to reflect a preference for algorithms that have been approved by a specific compliance regime.

Setting this policy does not guarantee that any specific algorithms will be negotiated.

This policy exists to allow server operators who wish to support clients with and without compliance requirements to differentiate between those clients, and only use certain non-default algorithms with increased cryptographic strength for those explicitly configured to prefer them.

Setting the policy to 'cnsa2' configures Samsung Browser to prefer key exchange methods required for compliance with the Commercial National Security Algorithm Suite 2.0 (CNSA 2.0).

Not setting the policy, or setting it to 'default', configures Samsung Browser to use its default key exchange methods.

Setting this policy is not required for security. The default cryptography used by Samsung Browser is strong enough to withstand a brute force attack using the entire power of the Sun.

Setting this policy will cause Samsung Browser to be slower when accessing websites.

This policy only affects TLS 1.3 and QUIC; it does not affect earlier versions of TLS.

"cnsa2" = Prefer key exchange methods satisfying the requirements of CNSA 2.0
"default" = Use Samsung Browser's default supported groups

• Chrome (Windows) since version 24

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderAlternateURLs specifies a list of alternate URLs for extracting search terms from the search engine. The URLs should include the string '{searchTerms}'.

Leaving DefaultSearchProviderAlternateURLs unset means no alternate URLs are used to extract search terms.

Windows (Windows clients):

Software\Policies\Samsung\Internet\DefaultSearchProviderAlternateURLs\1 = "https://search.my.company/suggest#q={searchTerms}" Software\Policies\Samsung\Internet\DefaultSearchProviderAlternateURLs\2 = "https://search.my.company/suggest/search#q={searchTerms}"

• Chrome (Windows) since version 8

If DefaultSearchProviderEnabled is on, setting DefaultSearchProviderEncodings specifies the character encodings supported by the search provider. Encodings are code page names such as UTF-8, GB2312, and ISO-8859-1. They're tried in the order provided.

Leaving DefaultSearchProviderEncodings unset puts UTF-8 in use.

Windows (Windows clients):

Software\Policies\Samsung\Internet\DefaultSearchProviderEncodings\1 = "UTF-8" Software\Policies\Samsung\Internet\DefaultSearchProviderEncodings\2 = "UTF-16" Software\Policies\Samsung\Internet\DefaultSearchProviderEncodings\3 = "GB2312" Software\Policies\Samsung\Internet\DefaultSearchProviderEncodings\4 = "ISO-8859-1"

• Chrome (Windows) since version 29

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderImageURL specifies the URL of the search engine used for image search. (If DefaultSearchProviderImageURLPostParams is set, then image search requests use the POST method instead.)

Leaving DefaultSearchProviderImageURL unset means no image search is used.

If image search uses the GET method, then the URL must specify image
parameters using a valid combination of the following placeholders:
'{google:imageURL}',
'{google:imageOriginalHeight}',
'{google:imageOriginalWidth}',
'{google:processedImageDimensions}',
'{google:imageSearchSource}',
'{google:imageThumbnail}',
'{google:imageThumbnailBase64}'.

• Chrome (Windows) since version 29

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderImageURLPostParams specifies the parameters during image search with POST. It consists of comma-separated, name-value pairs. If a value is a template parameter, such as {imageThumbnail}, real image thumbnail data replaces it.

Leaving DefaultSearchProviderImageURLPostParams unset means image search request is sent using the GET method.

The URL must specify the image parameter using a valid combination of
the following placeholders depending on what the search provider supports:
'{google:imageURL}',
'{google:imageOriginalHeight}',
'{google:imageOriginalWidth}',
'{google:processedImageDimensions}',
'{google:imageSearchSource}',
'{google:imageThumbnail}',
'{google:imageThumbnailBase64}'.

• Chrome (Windows) since version 8

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderKeyword specifies the keyword or shortcut used in the address bar to trigger the search for this provider.

Leaving DefaultSearchProviderKeyword unset means no keyword activates the search provider.

• Chrome (Windows) since version 8

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderName specifies the default search provider's name.

Leaving DefaultSearchProviderName unset means the hostname specified by the search URL is used.

• Chrome (Windows) since version 30

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderNewTabURL specifies the URL of the search engine used to provide a New Tab page.

Leaving DefaultSearchProviderNewTabURL unset means no new tab page is provided.

• Chrome (Windows) since version 8

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderSearchURL specifies the URL of the search engine used during a default search. The URL should include the string '{searchTerms}', replaced in the query by the user's search terms.

You can specify Google's search URL as: '{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}ie={inputEncoding}'.

• Chrome (Windows) since version 29

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderSearchURLPostParams specifies the parameters when searching a URL with POST. It consists of comma-separated, name-value pairs. If a value is a template parameter, such as '{searchTerms}', real search terms data replaces it.

Leaving DefaultSearchProviderSearchURLPostParams unset means search requests are sent using the GET method.

• Chrome (Windows) since version 8

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderSuggestURL specifies the URL of the search engine to provide search suggestions. The URL should include the string '{searchTerms}', replaced in the query by the user's search terms.

You can specify Google's search URL as: '{google:baseURL}complete/search?output=chrome&q={searchTerms}'.

• Chrome (Windows) since version 29

If DefaultSearchProviderEnabled is on, then setting DefaultSearchProviderSuggestURLPostParams specifies the parameters during suggestion search with POST. It consists of comma-separated, name-value pairs. If a value is a template parameter, such as '{searchTerms}', real search terms data replaces it.
Leaving DefaultSearchProviderSuggestURLPostParams unset means suggest search requests are sent using the GET method.

• Chrome (Windows) since version 80

Controls external extensions installation.

Setting this policy to Enabled blocks external extensions from being installed.

Setting this policy to Disabled or leaving it unset allows external extensions to be installed.

Note: This policy only applies to platforms that support extensions.

true = Block installation of external extensions
false = Allow installation of external extensions

• Chrome (Windows) since version 25

Setting the policy controls which apps and extensions may be installed in Samsung Browser, which hosts they can interact with, and limits runtime access.

Leaving the policy unset results in no restrictions on the acceptable extension and app types.

Extensions and apps which have a type that's not on the list won't be installed. Each value should be one of these strings:

* "extension"

* "theme"

* "user_script"

* "hosted_app"

* "legacy_packaged_app"

* "platform_app"

See the Samsung Browser extensions documentation for more information on these types.

Versions earlier than 75 that use multiple comma separated extension IDs aren't supported and are skipped. The rest of the policy applies.

Note: This policy also affects extensions and apps to be force-installed using ExtensionInstallForcelist.

Note: This policy only applies to platforms that support extensions.

"extension" = Extension
"theme" = Theme
"user_script" = User script
"hosted_app" = Hosted app
"legacy_packaged_app" = Legacy packaged app
"platform_app" = Platform app

Windows (Windows clients):

Software\Policies\Samsung\Internet\ExtensionAllowedTypes\1 = "hosted_app"

• Chrome (Windows) since version 128

Control if users can turn on Developer Mode on internet://extensions.

If the policy is not set, users can turn on developer mode on extension page unless DeveloperToolsAvailability policy is set to DeveloperToolsDisallowed (2).
If the policy is set to Allow (0), users can turn on developer mode on extensions page.
If the policy is set to Disallow (1), users can not turn on developer mode on extensions page.

If this policy is set, DeveloperToolsAvailability can no longer control extensions developer mode.

Note: This policy only applies to platforms that support extensions.

0 = Allow the usage of developer mode on extensions page
1 = Do not allow the usage of developer mode on extensions page

• Chrome (Windows) since version 112

Extensions that connect to one of these origins will be be kept running as long as the port is connected.

If unset, the policy's default values will be used. These are app origins that offer SDKs that are known to not offer the possibility to restart a closed connection to a previous state:
- Smart Card Connector
- Citrix Receiver (stable, beta, back-up)
- VMware Horizon (stable, beta)

If set, the default value list is extended with the newly configured values. Both defaults and the policy-provided entries will grant the exception to the connecting extensions, as long as the port is connected.

Windows (Windows clients):

Software\Policies\Samsung\Internet\ExtensionExtendedBackgroundLifetimeForPortConnectionsToUrls\1 = "chrome-extension://abcdefghijklmnopabcdefghijklmnop/" Software\Policies\Samsung\Internet\ExtensionExtendedBackgroundLifetimeForPortConnectionsToUrls\2 = "chrome-extension://bcdefghijklmnopabcdefghijklmnopa/"

• Chrome (Windows) since version 86

Allows you to specify which extensions the users can NOT install. Extensions already installed will be disabled if blocked, without a way for the user to enable them. Once an extension disabled due to the blocklist is removed from it, it will automatically get re-enabled.

A blocklist value of '*' means all extensions are blocked by default. Extensions that are explicitly listed in the allowlist are allowed if they are signed (packed). All unpacked extensions are blocked.

If this policy is left not set the user can install any extension in Samsung Browser.

Note: This policy only applies to platforms that support extensions.

Windows (Windows clients):

Software\Policies\Samsung\Internet\ExtensionInstallBlocklist\1 = "extension_id1" Software\Policies\Samsung\Internet\ExtensionInstallBlocklist\2 = "extension_id2"

• Chrome (Windows) since version 9

Setting the policy specifies a list of apps and extensions that install silently, without user interaction, and which users can't uninstall or turn off through the Samsung Browser interface. Permissions are granted implicitly, including for the enterprise.deviceAttributes and enterprise.platformKeys extension APIs. (These 2 APIs aren't available to apps and extensions that aren't force-installed.)

Although Samsung Browser aims to prevent users from uninstalling these extensions, some operating systems make it impossible for Samsung Browser to defend robustly against extensions being modified externally, so this prevention is best efforts.

Leaving the policy unset means no apps or extensions are autoinstalled, and users can uninstall any app or extension in Samsung Browser.

This policy supersedes ExtensionInstallBlocklist policy. If a previously force-installed app or extension is removed from this list, Samsung Browser automatically uninstalls it.

The source code of any extension may be altered by users through developer tools, potentially rendering the extension dysfunctional. If this is a concern, set the DeveloperToolsDisabled policy.

Each list item of the policy is a string that contains an extension ID and, optionally, an update URL separated by a semicolon (;). The extension ID is the 32-letter string found, for example, on internet://extensions when in Developer mode. If specified, the update URL should point to an Update Manifest XML document. The update URL should use one of the following schemes: http, https or file. By default, the Chrome Web Store's update URL is used. The update URL set in this policy is only used for the initial installation; subsequent updates of the extension use the update URL in the extension's manifest. The update url for subsequent updates can be overridden using the ExtensionSettings policy.

On Microsoft® Windows® instances, apps and extensions from outside the Chrome Web Store can only be forced installed if the instance is joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Samsung Browser.

Note: This policy doesn't apply to Incognito mode.

Note: This policy only applies to platforms that support extensions.

Windows (Windows clients):

Software\Policies\Samsung\Internet\ExtensionInstallForcelist\1 = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa;https://clients2.google.com/service/update2/crx" Software\Policies\Samsung\Internet\ExtensionInstallForcelist\2 = "abcdefghijklmnopabcdefghijklmnop"

• Chrome (Windows) since version 21

Setting the policy specifies which URLs may install extensions, apps, and themes. Before Samsung Browser 21, users could click on a link to a *.crx file, and Samsung Browser would offer to install the file after a few warnings. Afterwards, such files must be downloaded and dragged to the Samsung Browser settings page. This setting allows specific URLs to have the old, easier installation flow.

Each item in this list is an extension-style match pattern. Users can easily install items from any URL that matches an item in this list. Both the location of the *.crx file and the page where the download is started from (the referrer) must be allowed by these patterns.

ExtensionInstallBlocklist takes precedence over this policy. That is, an extension on the blocklist won't be installed, even if it happens from a site on this list.

Note: This policy only applies to platforms that support extensions.

Windows (Windows clients):

Software\Policies\Samsung\Internet\ExtensionInstallSources\1 = "https://corp.mycompany.com/*"

• Chrome (Windows) since version 120

The blocklist controls which extensions install types are disallowed.

Setting "command_line" will block extension from being loaded from
command line.

"command_line" = Blocks extensions from being loaded from command line

Windows (Windows clients):

Software\Policies\Samsung\Internet\ExtensionInstallTypeBlocklist\1 = "command_line"

• Chrome (Windows) since version 115

If this policy is enabled, extensions that are unpublished on the Chrome Web
Store will be disabled in Samsung Browser.
This policy only applies to extensions that are installed and updated from the
Chrome Web Store.

Off-store extensions such as unpacked extensions installed using developer
mode and extensions installed using the command-line switch are ignored.
Force-installed extensions that are self-hosted are ignored. All
version-pinned extensions are also ignored.

If the policy is set to AllowUnpublished (0) or not set, extensions that are unpublished on the Chrome Web Store are allowed.
If the policy is set to DisableUnpublished (1), extensions that are unpublished on the Chrome Web Store are disabled.

0 = Allow unpublished extensions
1 = Disable unpublished extensions

• Chrome (Windows) since version 100

Setting the policy specifies for which origins to allow all the HTTP authentication schemes Samsung Browser supports regardless of the AuthSchemes policy.

Up to 1,000 exceptions can be defined in AllHttpAuthSchemesAllowedForOrigins. Wildcards are allowed for the whole origin or parts of the origin, either the scheme, host, port.

Windows (Windows clients):

Software\Policies\Samsung\Internet\AllHttpAuthSchemesAllowedForOrigins\1 = "*.example.com"

• Chrome (Windows) since version 13

Setting the policy to Enabled allows third-party images on a page to show an authentication prompt.

Setting the policy to Disabled or leaving it unset renders third-party images unable to show an authentication prompt.

Typically, this policy is Disabled as a phishing defense.

true = Allow third-party images to show an authentication prompt
false = Prevent third-party images from showing an authentication prompt

• Chrome (Windows) since version 86

Setting the policy assigns servers that Samsung Browser may delegate to. Separate multiple server names with commas. Wildcards, *, are allowed.

Leaving the policy unset means Samsung Browser won't delegate user credentials, even if a server is detected as intranet.

• Chrome (Windows) since version 9

Setting the policy specifies which HTTP authentication schemes Samsung Browser supports.

Leaving the policy unset employs all 4 schemes.

Valid values:

* basic

* digest

* ntlm

* negotiate

Note: Separate multiple values with commas.

• Chrome (Windows) since version 86

Setting the policy specifies which servers should be allowed for integrated authentication. Integrated authentication is only on when Samsung Browser gets an authentication challenge from a proxy or from a server in this permitted list.

Leaving the policy unset means Samsung Browser tries to detect if a server is on the intranet. Only then will it respond to IWA requests. If a server is detected as internet, then Samsung Browser ignores IWA requests from it.

Note: Separate multiple server names with commas. Wildcards, *, are allowed.

• Chrome (Windows) since version 88

Setting the policy to Enabled or leaving it unset will allow Basic authentication challenges received over non-secure HTTP.

Setting the policy to Disabled forbids non-secure HTTP requests from using the Basic authentication scheme; only secure HTTPS is allowed.

This policy setting is ignored (and Basic is always forbidden) if the AuthSchemes policy is set and does not include Basic.

true = Basic authentication is allowed on HTTP connections
false = Non-secure HTTP connections are not permitted to use Basic authentication; HTTPS is required

• Chrome (Windows) since version 9

Setting the policy to Enabled skips CNAME lookup. The server name is used as entered when generating the Kerberos SPN.

Setting the policy to Disabled or leaving it unset means CNAME lookup determines the canonical name of the server when generating the Kerberos SPN.

true = Disable CNAME lookup during Kerberos authentication
false = Use CNAME lookup during Kerberos authentication

• Chrome (Windows) since version 9

Setting the policy to Enabled and entering a nonstandard port (in other words, a port other than 80 or 443) includes it in the generated Kerberos SPN.

Setting the policy to Disabled or leaving it unset means the generated Kerberos SPN won't include a port.

true = Include non-standard port in generated Kerberos SPN
false = Do not include port in generated Kerberos SPN

• Chrome (Windows) since version 116

List of actions to run when the timeout from the IdleTimeout policy is reached.

Warning: Setting this policy can impact and permanently remove local personal data. It is recommended to test your settings before deploying to prevent accidental deletion of personal data.

If the IdleTimeout policy is unset, this policy has no effect.

When the timeout from the IdleTimeout policy is reached, the browser runs the actions configured in this policy.

If this policy is empty or left unset, the IdleTimeout policy has no effect.

Supported actions are:

'close_browsers': close all browser windows and PWAs for this profile.

'close_tabs': close all open tabs in open windows.

'show_profile_picker': show the Profile Picker window.

'sign_out': Signs out the current signed in user.

'clear_browsing_history', 'clear_download_history', 'clear_cookies_and_other_site_data', 'clear_cached_images_and_files', 'clear_password_signing', 'clear_autofill', 'clear_site_settings', 'clear_hosted_app_data': clear the corresponding browsing data. See the ClearBrowsingDataOnExitList policy for more details.

'reload_pages': reload all webpages. For some pages, the user may be prompted for confirmation first.

The user will stay signed into their Google account when deleting cookies using 'clear_cookies_and_other_site_data'.

Setting 'clear_browsing_history', 'clear_password_signing', 'clear_autofill', and 'clear_site_settings' will disable sync for the respective data types if neither sync is disabled by setting the SyncDisabled policy nor BrowserSignin is disabled.

"close_browsers" = Close Browsers
"show_profile_picker" = Show Profile Picker
"clear_browsing_history" = Clear Browsing History
"clear_download_history" = Clear Download History
"clear_cookies_and_other_site_data" = Clear Cookies and Other Site Data
"clear_cached_images_and_files" = Clear Cached Images and Files
"clear_password_signin" = Clear Password Signin
"clear_autofill" = Clear Autofill
"clear_site_settings" = Clear Site Settings
"clear_hosted_app_data" = Clear Hosted App Data
"reload_pages" = Reload Pages
"sign_out" = Sign Out
"close_tabs" = Close Tabs

Windows (Windows clients):

Software\Policies\Samsung\Internet\IdleTimeoutActions\1 = "close_browsers" Software\Policies\Samsung\Internet\IdleTimeoutActions\2 = "show_profile_picker"

• Chrome (Windows) since version 111

Configures automatic user sign-in for accounts backed by a Microsoft® cloud identity provider.

By setting this policy to 1 (Enabled), users who sign into their computer with an account backed by a Microsoft® cloud identity provider (i.e., Microsoft® Azure® Active Directory® or the consumer Microsoft® account identity provider) or who have added a work or school account to Microsoft® Windows® can be signed into web properties using that identity automatically. Information pertaining to the user's device and account is transmitted to the user's cloud identity provider for each authentication event.

By setting this policy to 0 (Disabled) or leaving it unset, automatic sign-in as described above is disabled.

This feature is available starting in Microsoft® Windows® 10.

Note: This policy doesn't apply to Incognito or Guest modes.

0 = Disable Microsoft® cloud authentication
1 = Enable Microsoft® cloud authentication

• Chrome (Windows) since version 65

If SafeBrowsingEnabled is not Disabled, then setting AbusiveExperienceInterventionEnforce to Enabled or leaving it unset prevents sites with abusive experiences from opening new windows or tabs.

Setting SafeBrowsingEnabled to Disabled or AbusiveExperienceInterventionEnforce to Disabled lets sites with abusive experiences open new windows or tabs.

true = Prevent sites with abusive experiences from opening new windows or tabs
false = Allow sites with abusive experiences to open new windows or tabs

• Chrome (Windows) since version 92

This policy controls whether Samsung Browser may query additional DNS record types when making insecure DNS requests. This policy has no effect on DNS queries made via Secure DNS, which may always query additional DNS types.

If this policy is unset or set to Enabled, additional types such as HTTPS (DNS type 65) may be queried in addition to A (DNS type 1) and AAAA (DNS type 28).

If this policy is set to Disabled, DNS will only be queried for A (DNS type 1) and/or AAAA (DNS type 28).

This policy is a temporary measure and will be removed in future versions of Samsung Browser. After removal of the policy, Samsung Browser will always be able to query additional DNS types.

true = Allow additional DNS query types
false = Prevent additional DNS query types

• Chrome (Windows) since version 65

Unless SafeBrowsingEnabled is set to False, then setting AdsSettingForIntrusiveAdsSites to 1 or leaving it unset allows ads on all sites.

Setting the policy to 2 blocks ads on sites with intrusive ads.

1 = Allow ads on all sites
2 = Do not allow ads on sites with intrusive ads

• Chrome (Windows) since version 83

This policy controls whether users enrolled in the Advanced Protection program receive extra protections. Some of these features may involve the sharing of data with Google (for example, Advanced Protection users will be able to send their downloads to Google for malware scanning). If set to True or not set, enrolled users will receive extra protections. If set to False, Advanced Protection users will receive only the standard consumer features.

true = Users enrolled in the Advanced Protection program will receive extra protections
false = Users enrolled in the Advanced Protection program will only receive standard consumer protections

• Chrome (Windows) since version 116

This policy controls if a page with Cache-Control: no-store header can be stored in back/forward cache. The website setting this header may not expect the page to be restored from back/forward cache since some sensitive information could still be displayed after the restoration even if it is no longer accessible.

If the policy is enabled or unset, the page with Cache-Control: no-store header might be restored from back/forward cache unless the cache eviction is triggered (e.g. when there is HTTP-only cookie change to the site).

If the policy is disabled, the page with Cache-Control: no-store header will not be stored in back/forward cache.

true = Allow pages with Cache-Control: no-store header to be stored in back/forward cache.
false = Disallow pages with Cache-Control: no-store header to be stored in back/forward cache.

• Chrome (Windows) since version 57

Setting the policy to Enabled or leaving it unset means browser history and download history can be deleted in Samsung Browser, and users can't change this setting.

Setting the policy to Disabled means browser history and download history can't be deleted. Even with this policy off, the browsing and download history are not guaranteed to be retained. Users may be able to edit or delete the history database files directly, and the browser itself may expire or archive any or all history items at any time.

true = Enable deleting browser and download history
false = Disable deleting browser and download history

• Chrome (Windows) since version 48

Setting the policy to True allows users to play the dinosaur game. Setting the policy to False means users can't play the dinosaur easter egg game when device is offline.

Leaving the policy unset means users can play the game.

true = Enable dinosaur easter egg game
false = Disable dinosaur easter egg game
not set = Enable dinosaur easter egg game

• Chrome (Windows) since version 12

Setting the policy to Enabled or leaving it unset means Samsung Browser can display, and users can open, file selection dialogs.

Setting the policy to Disabled means that whenever users perform actions provoking a file selection dialog, such as importing bookmarks, uploading files, and saving links, a message appears instead. The user is assumed to have clicked Cancel on the file selection dialog.

true = Allow file selection dialogs
false = Prevent file selection dialogs

• Chrome (Windows) since version 110

If set to Enabled, Samsung Browser will
allow Web Authentication requests on websites that have TLS certificates with
errors (i.e. websites considered not secure).

If the policy is set to Disabled or left unset, the default behavior of
blocking such requests will apply.

true = Allow WebAuthn API requests on sites with broken TLS certificates.
false = Do not allow WebAuthn API requests on sites with broken TLS certificates.

• Chrome (Windows) since version 8

Setting the policy to True means Samsung Browser uses alternate error pages built into Samsung Browser (such as "page not found"). Setting the policy to False means Samsung Browser never uses alternate error pages.

If you set the policy, users can't change it. If not set, the policy is on, but users can change this setting.

true = Enable alternate error pages
false = Disable alternate error pages
not set = Allow the user to decide

• Chrome (Windows) since version 55

Setting the policy to Enabled turns the internal PDF viewer off in Samsung Browser, treats PDF files as a download, and lets users open PDFs with the default application.

Setting the policy to Disabled means that unless users turns off the PDF plugin, it will open PDF files.

If you set the policy, users can't change it in Samsung Browser. If not set, users can choose whether to open PDF externally or not.

true = Always open PDF files using an external PDF viewer
false = Always open PDF files using the internal PDF viewer
not set = Allow the user to decide

• Chrome (Windows) since version 80

Configuring this policy will allow/disallow ambient authentication for Incognito and Guest profiles in Samsung Browser.

Ambient Authentication is http authentication with default credentials if explicit credentials are not provided via NTLM/Kerberos/Negotiate challenge/response schemes.

Setting the RegularOnly (value 0), allows ambient authentication for Regular sessions only. Incognito and Guest sessions wouldn't be allowed to ambiently authenticate.

Setting the IncognitoAndRegular (value 1), allows ambient authentication for Incognito and Regular sessions. Guest sessions wouldn't be allowed to ambiently authenticate.

Setting the GuestAndRegular (value 2), allows ambient authentication for Guest and Regular sessions. Incognito sessions wouldn't be allowed to ambiently authenticate.

Setting the All (value 3), allows ambient authentication for all sessions.

Note that, ambient authentication is always allowed on regular profiles.

In Samsung Browser version 81 and later, if the policy is left not set, ambient authentication will be enabled in regular sessions only.

0 = Enable ambient authentication in regular sessions only.
1 = Enable ambient authentication in incognito and regular sessions.
2 = Enable ambient authentication in guest and regular sessions.
3 = Enable ambient authentication in regular, incognito and guest sessions.

• Chrome (Windows) since version 125

Setting the policy to Enabled or leaving it unset binds encryption keys used for local data storage to Samsung Browser whenever that is possible.

Setting the policy to Disabled has a detrimental effect on Samsung Browser's security as unknown and potentially hostile apps can retrieve encryption keys used to secure data.

Only turn off the policy if there are compatibility issues, such as other applications that need legitimate access to Samsung Browser's data, encrypted user data is expected to be fully portable between different computers or the integrity and location of Samsung Browser's executable files is not consistent.

true = Enable Application Bound Encryption
false = Disable Application Bound Encryption

• Chrome (Windows) since version 8

Setting the policy specifies the locale Samsung Browser uses.

Turning it off or leaving it unset means the locale will be the first valid locale from:
1) The user specified locale (if configured).
2) The system locale.
3) The fallback locale (en-US).

• Chrome (Windows) since version 25

Setting the policy to Enabled or leaving it unset means that, with the exception of URLs set in the AudioCaptureAllowedUrls list, users get prompted for audio capture access.

Setting the policy to Disabled turns off prompts, and audio capture is only available to URLs set in the AudioCaptureAllowedUrls list.

Note: The policy affects all audio input (not just the built-in microphone).

true = Enable audio input
false = Disable audio input

• Chrome (Windows) since version 29

Setting the policy means you specify the URL list whose patterns get matched to the security origin of the requesting URL. A match grants access to audio capture devices without prompt.

Note, however, that the pattern "*", which matches any URL, is not supported by this policy.

Windows (Windows clients):

Software\Policies\Samsung\Internet\AudioCaptureAllowedUrls\1 = "https://www.example.com/" Software\Policies\Samsung\Internet\AudioCaptureAllowedUrls\2 = "https://[*.]example.edu/"

• Chrome (Windows) since version 90

This policy controls the priority of the audio process on Windows.
If this policy is enabled, the audio process will run with above normal priority.
If this policy is disabled, the audio process will run with normal priority.
If this policy is not set, the default configuration for the audio process will be used.
This policy is intended as a temporary measure to give enterprises the ability to
run audio with higher priority to address certain performance issues with audio capture.
This policy will be removed in the future.

true = Use high priority for audio process
false = Use normal Priority for audio process
not set = Use default priority for audio process

• Chrome (Windows) since version 79

This policy controls the audio process sandbox.
If this policy is enabled, the audio process will run sandboxed.
If this policy is disabled, the audio process will run unsandboxed and the WebRTC audio-processing module will run in the renderer process.
This leaves users open to security risks related to running the audio subsystem unsandboxed.
If this policy is not set, the default configuration for the audio sandbox will be used, which may differ per platform.
This policy is intended to give enterprises flexibility to disable the audio sandbox if they use security software setups that interfere with the sandbox.

true = Always sandbox the audio process
false = Never sandbox the audio process
not set = Use the default configuration for the audio sandbox

• Chrome (Windows) since version 85

Allows you to set a list of protocols, and for each protocol an associated list of allowed origin patterns, that can launch an external application without prompting the user. The trailing separator should not be included when listing the protocol, so list "skype" instead of "skype:" or "skype://".

If this policy is set, a protocol will only be permitted to launch an external application without prompting by policy if the protocol is listed, and the origin of the site trying to launch the protocol matches one of the origin patterns in that protocol's allowed_origins list. If either condition is false the external protocol launch prompt will not be omitted by policy.

If this policy is not set, no protocols can launch without a prompt by default. Users may opt out of prompts on a per-protocol/per-site basis unless the ExternalProtocolDialogShowAlwaysOpenCheckbox policy is set to Disabled. This policy has no impact on per-protocol/per-site prompt exemptions set by users.

However, origin matching patterns for this policy cannot contain "/path" or "@query" elements. Any pattern that does contain a "/path" or "@query" element will be ignored.

Windows (Windows clients):

Software\Policies\Samsung\Internet\AutoLaunchProtocolsFromOrigins = [ { "allowed_origins": [ "example.com", "http://www.example.com:8080" ], "protocol": "spotify" }, { "allowed_origins": [ "https://example.com", "https://.mail.example.com" ], "protocol": "teams" }, { "allowed_origins": [ "*" ], "protocol": "outlook" } ]

• Chrome (Windows) since version 84

List of URLs specifying which URLs AutoOpenFileTypes will apply to. This policy has no impact on automatically open values set by users.

If this policy is set, files will only automatically open by policy if the URL is part of this set and the file type is listed in AutoOpenFileTypes. If either condition is false the download won't automatically open by policy.

If this policy isn't set, all downloads where the file type is in AutoOpenFileTypes will automatically open.

A URL pattern has to be formatted according to the supported URL-pattern format.

Windows (Windows clients):

Software\Policies\Samsung\Internet\AutoOpenAllowedForURLs\1 = "example.com" Software\Policies\Samsung\Internet\AutoOpenAllowedForURLs\2 = "https://ssl.server.com" Software\Policies\Samsung\Internet\AutoOpenAllowedForURLs\3 = "hosting.com/good_path" Software\Policies\Samsung\Internet\AutoOpenAllowedForURLs\4 = "https://server:8080/path" Software\Policies\Samsung\Internet\AutoOpenAllowedForURLs\5 = ".exact.hostname.com"

• Chrome (Windows) since version 84

List of file types that should be automatically opened on download. The leading separator should not be included when listing the file type, so list "txt" instead of ".txt".

Files with types that should be automatically opened will still be subject to the enabled safe browsing checks and won't be opened if they fail those checks.

If this policy isn't set, only file types that a user has already specified to automatically be opened will do so when downloaded.

On Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Samsung Browser.

Windows (Windows clients):

Software\Policies\Samsung\Internet\AutoOpenFileTypes\1 = "exe" Software\Policies\Samsung\Internet\AutoOpenFileTypes\2 = "txt"

• Chrome (Windows) since version 69

Setting the policy to True or leaving it unset gives users control of Autofill for addresses in the UI.

Setting the policy to False means Autofill never suggests or fills address information, nor does it save additional address information that users submit while browsing the web.

true = Enable AutoFill for addresses
false = Disable AutoFill for addresses

• Chrome (Windows) since version 63

Setting the policy to True or leaving it unset means users can control autofill suggestions for credit cards in the UI.

Setting the policy to False means autofill never suggests or fills credit card information, nor will it save additional credit card information that users might submit while browsing the web.

true = Enable AutoFill for credit cards
false = Disable AutoFill for credit cards

• Chrome (Windows) since version 66

Setting the policy to True lets Samsung Browser autoplay media. Setting the policy to False stops Samsung Browser from autoplaying media.

If this policy is left unset, Samsung Browser doesn't autoplay media. But, for certain URL patterns, you can use the AutoplayAllowlist policy to change this setting.

If this policy changes while Samsung Browser is running, it only applies to newly opened tabs.

true = Allow Samsung Browser to autoplay media
false = Do not allow Samsung Browser to autoplay media
not set = Do not allow Samsung Browser to autoplay media unless the URL is specified in the AutoplayAllowlist policy

• Chrome (Windows) since version 86

Setting the policy lets videos play automatically (without user consent) with audio content in Samsung Browser. If AutoplayAllowed policy is set to True, then this policy has no effect. If AutoplayAllowed is set to False, then any URL patterns set in this policy can still play. If this policy changes while Samsung Browser is running, it only applies to newly opened tabs.

Windows (Windows clients):

Software\Policies\Samsung\Internet\AutoplayAllowlist\1 = "https://www.example.com" Software\Policies\Samsung\Internet\AutoplayAllowlist\2 = "[*.]example.edu"

• Chrome (Windows) since version 19

Setting the policy to Enabled turns background mode on. In background mode, a Samsung Browser process is started on OS sign-in and keeps running when the last browser window is closed, allowing background apps and the browsing session to remain active. The background process displays an icon in the system tray and can always be closed from there.

Setting the policy to Disabled turns background mode off.

If you set the policy, users can't change it in the browser settings. If unset, background mode is off at first, but users can change it.

true = Enable background mode
false = Disable background mode
not set = Allow the user to decide

• Chrome (Windows) since version 108

This policy enables or disables the Battery Saver Mode setting.
On Samsung Browser, this setting makes it so that frame rate is throttled to lower power consumption. If this policy is unset, the end user can control this setting in internet://settings/performance.
The different levels are:
Disabled (0): Battery Saver Mode will be disabled.
EnabledBelowThreshold (1): Battery Saver Mode will be enabled when the device is on battery power and battery level is low.
EnabledOnBattery (2): This value is deprecated as of M121. From M121 onwards, values will be treated as EnabledBelowThreshold.

0 = Battery Saver Mode will be disabled.
1 = Battery Saver Mode will be enabled when the device is on battery power and battery level is low.
2 = This value is deprecated as of M121. In M121 and after, values will be treated as EnabledBelowThreshold.

• Chrome (Windows) since version 10

Setting the policy to Enabled prevents webpage elements that aren't from the domain that's in the browser's address bar from setting cookies. Setting the policy to Disabled lets those elements set cookies and prevents users from changing this setting.

Leaving it unset allows third-party cookies, but users can change this setting.

Note: This policy doesn't apply in Incognito mode, where third-party cookies are blocked and can only be allowed at the site level. To allow cookies at the site level, use the CookiesAllowedForUrls policy.

true = Block 3rd party cookies
false = Allow 3rd party cookies
not set = Allow 3rd party cookies, but allow the user to change this setting

• Chrome (Windows) since version 12

Setting the policy to True displays a bookmark bar in Samsung Browser. Setting the policy to False means users never see the bookmark bar.

If you set the policy, users can't change it. If not set, users decide whether to use this function.

true = Enable bookmark bar
false = Disable bookmark bar
not set = Allow the user to decide

• Chrome (Windows) since version 39

If this policy is set to true or not configured, Samsung Browser will allow to add a new person from the user manager.

If this policy is set to false, Samsung Browser will not allow adding a new person from the user manager.

true = Allow adding new profiles
false = Disallow adding new profiles

• Chrome (Windows) since version 38

If this policy is set to Enabled or not configured, Samsung Browser will enable guest logins. Guest logins are Samsung Browser profiles where all windows are in incognito mode.

If this policy is set to Disabled, Samsung Browser will not allow guest profiles to be started.

true = Allow guest browser logins
false = Prevent guest browser logins

• Chrome (Windows) since version 77

Setting the policy to Enabled means Samsung Browser enforces guest sessions and prevents profile sign-ins. Guest sign-ins are Samsung Browser profiles where windows are in Incognito mode.

Setting the policy to Disabled, leaving it unset, or disabling browser Guest mode (through BrowserGuestModeEnabled) allows the use of new and existing profiles.

true = Only allow guest browser logins
false = Allow guest browser logins and profile logins

• Chrome (Windows) since version 95

Setting the policy to Enabled or leaving it unset will permit Samsung Browser to apply the additional extension point security mitigation to block legacy extension points in the Browser process.

Setting the policy to Disabled has a detrimental effect on Samsung Browser's security and stability as unknown and potentially hostile code can load inside Samsung Browser's browser process. Only turn off the policy if there are compatibility issues with third-party software that must run inside Samsung Browser's browser process.

true = Block legacy extension points in the Browser process
false = Do not block legacy extension points in the Browser process

• Chrome (Windows) since version 60

Setting the policy to Enabled or leaving it unset means Samsung Browser send occasional queries to a Google server to retrieve an accurate timestamp.

Setting the policy to Disabled stops Samsung Browser from sending these queries.

true = Allow queries to a Google server to retrieve an accurate timestamp
false = Do not allow queries to Google servers to retrieve timestamps

• Chrome (Windows) since version 70

This policy controls the sign-in behavior of the browser. It allows you to specify if the user can sign in to Samsung Browser with their account and use account related services like Samsung Browser Sync.

If the policy is set to "Disable browser sign-in" then the user cannot sign in to the browser and use account-based services. In this case browser-level features like Samsung Browser Sync cannot be used and will be unavailable. If the user was signed in and the policy is set to "Disabled" they will be signed out the next time they run Samsung Browser. Their local profile data like bookmarks, passwords etc. will be preserved and still usable. The user will still be able to sign into and use Google web services like Gmail.

If the policy is set to "Enable browser sign-in," then the user is allowed to sign in to the browser. The user is automatically signed in to the browser when signed in to Google web services like Gmail. Being signed in to the browser means the user's account information will be kept by the browser. However, it does not mean that Samsung Browser Sync will be turned on by default; the user must separately opt-in to use this feature. Enabling this policy will prevent the user from turning off the setting that allows browser sign-in. To control the availability of Samsung Browser Sync, use the SyncDisabled policy.

If the policy is set to "Force browser sign-in" the user is presented with an account selection dialog and has to choose and sign in to an account to use the browser. This ensures that for managed accounts the policies associated with the account are applied and enforced. The default value of BrowserGuestModeEnabled will be set to disabled. Note that existing unsigned profiles will be locked and inaccessible after enabling this policy.

If this policy is not set then the user can decide if they want to enable browser sign-in in the Samsung Browser settings and use it as they see fit.

0 = Disable browser sign-in
1 = Enable browser sign-in
2 = Force users to sign-in to use the browser

• Chrome (Windows) since version 91

This policy allows admins to configure the color of Samsung Browser's theme. The input string should be a valid hex color string matching the format "#RRGGBB".

Setting the policy to a valid hex color causes a theme based on that color to be automatically generated and applied to the browser. Users won't be able to change the theme set by the policy.

Leaving the policy unset lets users change their browser's theme as preferred.

• Chrome (Windows) since version 89

Configures browsing data lifetime settings for Samsung Browser. This policy allows admins to configure (per data-type) when data is deleted by the browser. This is useful for customers that work with sensitive customer data.

Warning: Setting this policy can impact and permanently remove local personal data. It is recommended to test your settings before deploying to prevent accidental deletion of personal data.

The available data types are 'browsing_history', 'download_history', 'cookies_and_other_site_data', 'cached_images_and_files', 'password_signin', 'autofill', 'site_settings' and 'hosted_app_data'. 'download_history' and 'hosted_app_data' are not supported on Android.

The browser will automatically remove data of selected types that is older than 'time_to_live_in_hours'. The minimum value that can be set is 1 hour.

The deletion of expired data will happen 15 seconds after the browser starts then every 30 minutes while the browser is running.

The user will stay signed into their Google account when deleting cookies.

Until Samsung Browser 114, this policy required the SyncDisabled policy to be set to true. Starting Samsung Browser 115, setting this policy will disable sync for the respective data types if neither `Samsung Browser Sync` is disabled by setting the SyncDisabled policy nor BrowserSignin is disabled.

Windows (Windows clients):

Software\Policies\Samsung\Internet\BrowsingDataLifetime = [ { "data_types": [ "browsing_history" ], "time_to_live_in_hours": 24 }, { "data_types": [ "password_signin", "autofill" ], "time_to_live_in_hours": 12 } ]

• Chrome (Windows) since version 137

This policy controls if a page can use the built-in AI APIs (such as LanguageModel API, Summarization API, Writer API, and Rewriter API).

If the policy is enabled or unset, the APIs are enabled to be used.

If the policy is disabled, attempting using the APIs will result in an error.

true = Allow the usage of the built-in AI APIs.
false = Disallow the usage of the built-in AI APIs.

• Chrome (Windows) since version 25

This policy controls which software stack is used to communicate with the DNS server: the Operating System DNS client, or Samsung Browser's built-in DNS client. This policy does not affect which DNS servers are used: if, for example, the operating system is configured to use an enterprise DNS server, that same server would be used by the built-in DNS client. It also does not control if DNS-over-HTTPS is used; Samsung Browser will always use the built-in resolver for DNS-over-HTTPS requests. Please see the DnsOverHttpsMode policy for information on controlling DNS-over-HTTPS.

If this policy is set to Enabled or is left unset, the built-in DNS client will be used.

If this policy is set to Disabled, the built-in DNS client will only be used when DNS-over-HTTPS is in use.

true = Always use the built-in DNS client
false = Never use the built-in DNS client
not set = Always use the built-in DNS client

• Chrome (Windows) since version 97

Configures support of CORS non-wildcard request headers.

Samsung Browser version 97 introduces support for CORS non-wildcard request headers. When scripts make a cross-origin network request via fetch() and XMLHttpRequest with a script-added Authorization header, the header must be explicitly allowed by the Access-Control-Allow-Headers header in the CORS preflight response. "Explicitly" here means that the wild card symbol "*" doesn't cover the Authorization header.

If this policy is not set, or set to True, Samsung Browser will support the CORS non-wildcard request headers and behave as described above.

When this policy is set to False, Samsung Browser will allow the wildcard symbol ("*") in the Access-Control-Allow-Headers header in the CORS preflight response to cover the Authorization header.

This Enterprise policy is temporary; it's intended to be removed in the future.

true = Support CORS non-wildcard request headers.
false = Do not support CORS non-wildcard request headers.

• Chrome (Windows) since version 146

This policy allows the administrators to encrypt browser http cache on disk.

When this policy is Enabled, browser cache will be encrypted.

When this policy is Disabled or not set, browser cache will not be encrypted.

Browser cache encryption may result in a performance impact.

true = Use the cache encryption.
false = Do not use the cache encryption.

• Chrome (Windows) since version 67

Setting the policy turns off enforcement of Certificate Transparency disclosure requirements for a list of subjectPublicKeyInfo hashes. Enterprise hosts can keep using certificates that otherwise wouldn't be trusted (because they weren't properly publicly disclosed). To turn off enforcement, the hash must meet one of these conditions:

* It's of the server certificate's subjectPublicKeyInfo.

* It's of a subjectPublicKeyInfo that appears in a Certificate Authority (CA) certificate in the certificate chain. That CA certificate is constrained through the X.509v3 nameConstraints extension, one or more directoryName nameConstraints are present in the permittedSubtrees, and the directoryName has an organizationName attribute.

* It's of a subjectPublicKeyInfo that appears in a CA certificate in the certificate chain, the CA certificate has one or more organizationName attributes in the certificate Subject, and the server's certificate has the same number of organizationName attributes, in the same order, and with byte-for-byte identical values.

Specify a subjectPublicKeyInfo hash by linking the hash algorithm name, a slash, and the Base64 encoding of that hash algorithm applied to the DER-encoded subjectPublicKeyInfo of the specified certificate. Base64 encoding format matches that of an SPKI Fingerprint. The only recognized hash algorithm is sha256; others are ignored.

Leaving the policy unset means that if certificates requiring disclosure through Certificate Transparency aren't disclosed, then Samsung Browser doesn't trust those certificates.

Windows (Windows clients):

Software\Policies\Samsung\Internet\CertificateTransparencyEnforcementDisabledForCas\1 = "sha256/AAAAAAAAAAAAAAAAAAAAAA==" Software\Policies\Samsung\Internet\CertificateTransparencyEnforcementDisabledForCas\2 = "sha256//////////////////////w=="

• Chrome (Windows) since version 53

Setting the policy turns off Certificate Transparency disclosure requirements for the hostnames in the specified URLs. While making it harder to detect misissued certificates, hosts can keep using certificates that otherwise wouldn't be trusted (because they weren't properly publicly disclosed).

Leaving the policy unset means that if certificates requiring disclosure through Certificate Transparency aren't disclosed, then Samsung Browser doesn't trust those certificates.

However, because the validity of certificates for a given hostname is independent of the scheme, port, or path, Samsung Browser only considers the hostname portion of the URL. Wildcard hosts aren't supported.

Windows (Windows clients):

Software\Policies\Samsung\Internet\CertificateTransparencyEnforcementDisabledForUrls\1 = "example.com" Software\Policies\Samsung\Internet\CertificateTransparencyEnforcementDisabledForUrls\2 = ".example.com"

• Chrome (Windows) since version 89

Configures a list of browsing data types that should be deleted when the user closes all browser windows.

Warning: Setting this policy can impact and permanently remove local personal data. It is recommended to test your settings before deploying to prevent accidental deletion of personal data.

The available data types are browsing history (browsing_history), download history (download_history), cookies (cookies_and_other_site_data), cache(cached_images_and_files), autofill (autofill), passwords (password_signin), site settings (site_settings) and hosted apps data (hosted_app_data). This policy does not take precedence over AllowDeletingBrowserHistory.

The user will stay signed into their Google account when deleting cookies.

If for some reason the data deletion has started and did not complete, the browsing data will be cleared the next time the profile is loaded.

If Samsung Browser does not exit cleanly (for example, if the browser or the OS crashes), the browsing data will not be cleared since the browser closing was not a result of the user closing all the browser windows.

"browsing_history" = Browsing history
"download_history" = Download history
"cookies_and_other_site_data" = Cookies and other site data
"cached_images_and_files" = Cached images and files
"password_signin" = Password signin
"autofill" = Autofill
"site_settings" = Site settings
"hosted_app_data" = Hosted apps data

Windows (Windows clients):

Software\Policies\Samsung\Internet\ClearBrowsingDataOnExitList\1 = "browsing_history" Software\Policies\Samsung\Internet\ClearBrowsingDataOnExitList\2 = "download_history" Software\Policies\Samsung\Internet\ClearBrowsingDataOnExitList\3 = "cookies_and_other_site_data" Software\Policies\Samsung\Internet\ClearBrowsingDataOnExitList\4 = "cached_images_and_files" Software\Policies\Samsung\Internet\ClearBrowsingDataOnExitList\5 = "password_signin" Software\Policies\Samsung\Internet\ClearBrowsingDataOnExitList\6 = "autofill" Software\Policies\Samsung\Internet\ClearBrowsingDataOnExitList\7 = "site_settings" Software\Policies\Samsung\Internet\ClearBrowsingDataOnExitList\8 = "hosted_app_data"

• Chrome (Windows) since version 79

Enable the Click to Call feature which allows users to send phone numbers from Samsung Browser desktops to an Android device when the user is signed in.

If this policy is set to enabled, the capability of sending phone numbers to Android devices will be enabled for the Samsung Browser user.

If this policy is set to disabled, the capability of sending phone numbers to Android devices will be disabled for the Samsung Browser user.

If you set this policy, users cannot change or override it.

If this policy is left unset, the Click to Call feature is enabled by default.

true = Allow users to send phone numbers from Samsung Browser to their Android device
false = Do not allow users to send phone numbers from Samsung Browser to their Android device
not set = Allow the user to decide

• Chrome (Windows) since version 72

Setting the policy to Enabled mandates Samsung Browser enrollment and blocks Samsung Browser launch process if failed.

Setting the policy to Disabled or leaving it unset renders Samsung Browser enrollment optional and doesn't block Samsung Browser launch process if failed.

Machine scope cloud policy enrollment on desktop uses this policy.

true = Prevent Samsung Browser from launching if not enrolled into Samsung Browser Cloud Management
false = Allow Samsung Browser to launch if not enrolled into Samsung Browser Cloud Management

• Chrome (Windows) since version 75

Setting the policy to Enabled means cloud policy takes precedence if it conflicts with platform policy.

Setting the policy to Disabled or leaving it unset means platform policy takes precedence if it conflicts with cloud policy.

This mandatory policy affects machine scope cloud policies.

This policy is specific to Samsung Browser and does not affect Google Update because they are independent applications.
Google Update has a separate policy with the same name.

true = Cloud machine policies take precedence over platform machine policies
false = Platform machine policies take precedence over cloud machine policies

• Chrome (Windows) since version 92

Setting the policy to Enabled allows policies associated with a managed account to be merged into machine-level policies.

Setting the policy to Disabled or leaving it unset prevents user-level cloud policies from being merged with policies from any other sources.

Only policies originating from secure users can take precedence. A secure user is affiliated with the organization that manages their browser using Samsung Browser. All other user-level policies will have default precedence.

Policies that need to be merged also need to be set in either PolicyListMultipleSourceMergeList or PolicyDictionaryMultipleSourceMergeList. This policy will be ignored if neither of the two aforementioned policies is configured.

true = Enable merging of user-level cloud policies.
false = Disable merging of user-level cloud policies.

• Chrome (Windows) since version 96

Setting the policy to Enabled allows policies associated with a managed account to take precedence if they conflict with Samsung Browser Enterprise Core browser policies.

Setting the policy to Disabled or leaving it unset causes user-level cloud policies to have default priority.

Only policies originating from secure users can take precedence. A secure user is affiliated with the organization that manages their browser using Samsung Browser Enterprise Core. All other user-level policies will have default precedence.

The policy can be combined with CloudPolicyOverridesPlatformPolicy. If both policies are enabled, user cloud policies will also take precedence over conflicting platform policies.

true = Allow user cloud policies to override machine cloud policies.
false = Prevent user cloud policies from overriding machine cloud policies.

• Chrome (Windows) since version 76

Setting the policy to Enabled or leaving it unset means security warnings appear when potentially dangerous command-line flags are used to launch Samsung Browser.

Setting the policy to Disabled prevents security warnings from appearing when Samsung Browser is launched with potentially dangerous command-line flags.

On Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Samsung Browser.

true = Show security warnings when potentially dangerous command-line flags are used
false = Hide security warnings when potentially dangerous command-line flags are used

• Chrome (Windows) since version 54

Enables component updates for all components in Samsung Browser when not set or set to enabled.

If set to disabled, updates to components are disabled. However, some components are exempt from this policy: updates to any component that does not contain executable code and is critical for the security of the browser will not be disabled.
Examples of such components include the certificate revocation lists and subresource filters.

true = Enable updates for all components
false = Disable updates for non-critical components

• Chrome (Windows) since version 80

This policy configures a local switch that can be used to disable DNS interception checks. The checks attempt to discover whether the browser is behind a proxy that redirects unknown host names.

This detection may not be necessary in an enterprise environment where the network configuration is known, since it causes some amount of DNS and HTTP traffic on start-up and each DNS configuration change.

When this policy is not set, or is enabled, the DNS interception checks are performed. When explicitly disabled, they're not.

true = Perform DNS interception checks
false = Do not perform DNS interception checks

• Chrome (Windows) since version 64

Setting the policy changes the default directory that Samsung Browser downloads files to, but users can change the directory.

Leaving the policy unset means Samsung Browser uses its platform-specific default directory.

This policy has no effect if the policy DownloadDirectory is set.

• Chrome (Windows) since version 85

Enables the use of a default search provider on the context menu.

If you set this policy to disabled the search context menu item that relies on your default search provider will not be available.

If this policy is set to enabled or not set, the context menu item for your default search provider will be available.

The policy value is only appled when the DefaultSearchProviderEnabled policy is enabled, and is not applicable otherwise.

true = Enable access to the default search provider context menu
false = Disable access to the default search provider context menu

• Chrome (Windows) since version 93

Setting the policy to True or leaving it unset lets users share or save the current webpage using actions provided by the desktop sharing hub. The sharing hub is accessed through either an omnibox icon or the 3-dot menu.

Setting the policy to False removes the sharing icon from the omnibox and the entry from the 3-dot menu.

true = Enable desktop sharing hub
false = Disable desktop sharing hub

• Chrome (Windows) since version 142

This policy controls the integration of the Google Developer Program with Samsung Browser DevTools. The user's Google Developer Program profile is shown in Samsung Browser DevTools, and users receive badges for performing specific actions within Samsung Browser DevTools.

Setting the policy to 0 - 'Enabled', or not setting any policy value, allows the integration of the Google Developer Program with Samsung Browser DevTools, and allows sharing of Samsung Browser DevTools tool usage in order to be able to award badges.

Setting the policy to 1 - 'Enabled without badges', allows the integration of the Google Developer Program with Samsung Browser DevTools, but does not allow sharing Samsung Browser DevTools tool usage with the Google Developer Program. No badges will be awarded.

Setting the policy to 2 - 'Disabled', does not allow the integration of the Google Developer Program with Samsung Browser DevTools.

0 = Enable Google Developer Program integration in Samsung Browser DevTools.
1 = Enable Google Developer Program integration in Samsung Browser DevTools, but without sharing tool usage (for awarding badges).
2 = Do not enable Google Developer Program integration in Samsung Browser DevTools.

• Chrome (Windows) since version 68

Setting the policy to 0 (the default) means you can access the developer tools and the JavaScript console, but not in the context of extensions installed by enterprise policy or, since version 114 and if this is a managed user, extensions built into the browser. Setting the policy to 1 means you can access the developer tools and the JavaScript console in all contexts, including that of extensions installed by enterprise policy. Setting the policy to 2 means you can't access developer tools, and you can't inspect website elements.

This setting also turns off keyboard shortcuts and menu or context menu entries to open developer tools or the JavaScript console.

As of Samsung Browser version 99, this setting also controls entry points for the 'View page source' feature. If you set this policy to 'DeveloperToolsDisallowed' (value 2), users cannot access source viewing via keyboard shortcut or the context menu. To fully block source viewing, you must also add 'view-source:*' to the URLBlocklist policy.

As of Samsung Browser version 119, this setting also controls whether developer mode for Isolated Web Apps can be activated and used.

As of Samsung Browser version 128, this setting will not control developer mode on extensions page if ExtensionDeveloperModeSettings policy is set.

The availability of Developer Tools is determined in the following order of precedence:
1. If a URL matches a pattern in the DeveloperToolsAvailabilityAllowlist policy, Developer Tools are allowed.
2. If the DeveloperToolsAvailabilityAllowlist is set and the DeveloperToolsAvailabilityBlocklist is not, any URL not on the allowlist is blocked.
3. If a URL matches a pattern in the DeveloperToolsAvailabilityBlocklist policy, Developer Tools are blocked.
4. If a URL is not covered by the allowlist or blocklist, this policy (DeveloperToolsAvailability) is the fallback.

0 = Disallow usage of the Developer Tools on apps and extensions installed by enterprise policy or, since version 114 and if this is a managed user, extensions built into the browser. Allow usage of the Developer Tools in other contexts
1 = Allow usage of the Developer Tools
2 = Disallow usage of the Developer Tools

• Chrome (Windows) since version 147

This policy can be used to allow Samsung Browser DevTools on specific URLs.

URL patterns are matched against the URL of every frame on the page being inspected. The resulting behavior depends on whether the DeveloperToolsAvailabilityBlocklist policy is also set.

If this policy is set and DeveloperToolsAvailabilityBlocklist is not, every frame's URL must match a pattern on this allowlist for Samsung Browser DevTools to be allowed. If any frame's URL does not match, Samsung Browser DevTools will be blocked for the entire page.

If both this and the DeveloperToolsAvailabilityBlocklist policies are set, this allowlist takes precedence. If a frame's URL matches a pattern on this allowlist, it will be allowed, even if it also matches a pattern in the blocklist. If a URL matches a pattern on the blocklist (but not the allowlist), it will be blocked. If a URL matches neither, the DeveloperToolsAvailability policy will be used as a fallback.

If this policy is not set, the availability of Samsung Browser DevTools is determined by the DeveloperToolsAvailabilityBlocklist and DeveloperToolsAvailability policies.

This policy also applies to Samsung Browser DevTools opened for extensions and web applications.

This policy is limited to 1,000 entries.

Windows (Windows clients):

Software\Policies\Samsung\Internet\DeveloperToolsAvailabilityAllowlist\1 = "example.com" Software\Policies\Samsung\Internet\DeveloperToolsAvailabilityAllowlist\2 = "https://ssl.server.com" Software\Policies\Samsung\Internet\DeveloperToolsAvailabilityAllowlist\3 = "hosting.com/bad_path" Software\Policies\Samsung\Internet\DeveloperToolsAvailabilityAllowlist\4 = "https://server:8080/path" Software\Policies\Samsung\Internet\DeveloperToolsAvailabilityAllowlist\5 = ".exact.hostname.com" Software\Policies\Samsung\Internet\DeveloperToolsAvailabilityAllowlist\6 = "file://*"

• Chrome (Windows) since version 147

This policy can be used to block Samsung Browser DevTools on specific URLs.

URL patterns are matched against the URL of every frame on the page being inspected. The resulting behavior depends on whether the DeveloperToolsAvailabilityAllowlist policy is also set.

If this policy is set and DeveloperToolsAvailabilityAllowlist is not, any frame's URL matching a pattern on this blocklist will block Samsung Browser DevTools for the entire page. If a frame's URL doesn't match any pattern, the availability is determined by the DeveloperToolsAvailability policy.

If both this and the DeveloperToolsAvailabilityAllowlist policies are set, the allowlist takes precedence. If a frame's URL matches a pattern on the allowlist, it will be allowed, even if it also matches a pattern in this blocklist. If a URL matches a pattern on this blocklist (but not the allowlist), it will be blocked. If a URL matches neither, the DeveloperToolsAvailability policy will be used as a fallback.

If this policy is not set, the availability of Samsung Browser DevTools is determined by the DeveloperToolsAvailabilityAllowlist and DeveloperToolsAvailability policies.

This policy is limited to 1,000 entries.

Windows (Windows clients):

Software\Policies\Samsung\Internet\DeveloperToolsAvailabilityBlocklist\1 = "https://example.com" Software\Policies\Samsung\Internet\DeveloperToolsAvailabilityBlocklist\2 = "example.com" Software\Policies\Samsung\Internet\DeveloperToolsAvailabilityBlocklist\3 = "https://ssl.server.com" Software\Policies\Samsung\Internet\DeveloperToolsAvailabilityBlocklist\4 = "hosting.com/bad_path" Software\Policies\Samsung\Internet\DeveloperToolsAvailabilityBlocklist\5 = "https://server:8080/path" Software\Policies\Samsung\Internet\DeveloperToolsAvailabilityBlocklist\6 = ".exact.hostname.com" Software\Policies\Samsung\Internet\DeveloperToolsAvailabilityBlocklist\7 = "*" Software\Policies\Samsung\Internet\DeveloperToolsAvailabilityBlocklist\8 = "file://*"

• Chrome (Windows) since version 9

Setting the policy to True (or setting HardwareAccelerationModeEnabled to False) prevents webpages from accessing the WebGL API.

Setting the policy to False or leaving it unset lets webpages use the WebGL API, but the browser's default settings might still require command line arguments to use these APIs.

true = Disable support for 3D graphics APIs
false = Enable support for 3D graphics APIs

• Chrome (Windows) since version 22

Setting the policy to Enabled disallows screenshots taken with keyboard shortcuts
or extension APIs. Setting the policy to Disabled or not set allows screenshots.

Note that on Microsoft® Windows®,
this does not prevent screenshots that are taken with operating system or third party applications.

true = Do not allow users to take screenshots or video recordings
false = Allow users to take screenshots and video recordings

• Chrome (Windows) since version 13

Setting the policy has Samsung Browser use the directory you provide for storing cached files on the disk—whether or not users specify the --disk-cache-dir flag.

If not set, Samsung Browser uses the default cache directory, but users can change that setting with the --disk-cache-dir command line flag.

Samsung Browser manages the contents of a volume's root directory. So to avoid data loss or other errors, do not set this policy to the root directory or any directory used for other purposes. See the available user-data-directory variables.

• Chrome (Windows) since version 17

Setting the policy to None has Samsung Browser use the default cache size for storing cached files on the disk. Users can't change it.

If you set the policy, Samsung Browser uses the cache size you provide—whether or not users specify the --disk-cache-size flag. (Values below a few megabytes are rounded up.)

If not set, Samsung Browser uses the default size. Users can change that setting using the --disk-cache-size flag.

Note: The value specified in this policy is used as a hint to various cache subsystems in the browser. Therefore the actual total disk consumption of all caches will be higher but within the same order of magnitude as the value specified.

• Chrome (Windows) since version 78

Controls the mode of the DNS-over-HTTPS resolver. Please note that this
policy will only set the default mode for each query. The mode may be
overridden for special types of queries such as requests to resolve a
DNS-over-HTTPS server hostname.

The "off" mode will disable
DNS-over-HTTPS.

The "automatic" mode will send
DNS-over-HTTPS queries first if a DNS-over-HTTPS server is available and
may fallback to sending insecure queries on error.

The "secure" mode will only send
DNS-over-HTTPS queries and will fail to resolve on error.

If this policy is unset, for managed devices DNS-over-HTTPS queries will not
be sent. Otherwise, the browser may send DNS-over-HTTPS requests to a
resolver associated with the user's configured system resolver.

"off" = Disable DNS-over-HTTPS
"automatic" = Enable DNS-over-HTTPS with insecure fallback
"secure" = Enable DNS-over-HTTPS without insecure fallback

• Chrome (Windows) since version 80

The URI template of the desired DNS-over-HTTPS resolver. To specify multiple DNS-over-HTTPS resolvers, separate the corresponding URI templates with spaces.

If the DnsOverHttpsMode is set to "secure" then this policy must be set and not empty.

If the DnsOverHttpsMode is set to "automatic" and this policy is set then the URI templates specified will be used; if this policy is unset then hardcoded mappings will be used to attempt to upgrade the user's current DNS resolver to a DoH resolver operated by the same provider.

If the URI template contains a dns variable, requests to the resolver will use GET; otherwise requests will use POST.

Incorrectly formatted templates will be ignored.

• Chrome (Windows) since version 11

Setting the policy sets up the directory Samsung Browser uses for downloading files. It uses the provided directory, whether or not users specify one or turned on the flag to be prompted for download location every time.

This policy overrides the DefaultDownloadDirectory policy.

Leaving the policy unset means Samsung Browser uses the default download directory, and users can change it.

• Chrome (Windows) since version 127

This policy controls the dynamic code settings for Samsung Browser.

Disabling dynamic code improves the security of Samsung Browser by preventing potentially hostile dynamic code and third-party code from making changes to Samsung Browser's behavior, but might cause compatibility issues with third-party software (e.g. certain printer drivers) that must run inside the browser process.

If the policy is set to 0 - Default or left unset then Samsung Browser will use the default settings.

If the policy is set to 1 - DisabledForBrowser then the Samsung Browser browser process will be prevented from creating dynamic code.

0 = Default dynamic code settings
1 = Prevent the browser process from creating dynamic code

• Chrome (Windows) since version 12

Setting the policy to True or leaving it unset lets users add, remove, modify, or upload bookmarks.

Setting the policy to False means users can't add, remove, modify or upload bookmarks. They can still use existing bookmarks.

true = Enable bookmark editing
false = Disable bookmark editing

• Chrome (Windows) since version 85

Allows Samsung Browser to load experimental policies.

WARNING: Experimental policies are unsupported and subject to change or be removed without notice in future version of the browser!

An experimental policy may not be finished or still have known or unknown defects. It may be changed or even removed without any notification. By enabling experimental policies, you could lose browser data or compromise your security or privacy.

If a policy is not in the list and it's not officially released, its value will be ignored on Beta and Stable channel.

If a policy is in the list and it's not officially released, its value will be applied.

This policy has no effect on already released policies.

Windows (Windows clients):

Software\Policies\Samsung\Internet\EnableExperimentalPolicies\1 = "ExtensionInstallAllowlist" Software\Policies\Samsung\Internet\EnableExperimentalPolicies\2 = "ExtensionInstallBlocklist"

• Chrome (Windows) since version 19

Setting the policy to True means online OCSP/CRL checks are performed.

Setting the policy to False or leaving it unset means Samsung Browser won't perform online revocation checks in Samsung Browser 19 and later.

Note: OCSP/CRL checks provide no effective security benefit.

true = Allow online OCSP/CRL checks to be performed
false = Prevent online OCSP/CRL checks from being performed

• Chrome (Windows) since version 139

A policy that controls if SwiftShader will be used as a WebGL fallback when hardware GPU acceleration is not available.

SwiftShader has been used to support WebGL on systems without GPU acceleration such as headless systems or virtual machines but has been deprecated due to security issues. Starting in M139, WebGL context creation will fail when it would have otherwise used SwiftShader. This policy allows the browser or administrator to temporarily defer the deprecation.

Setting the policy to Enabled, SwiftShader will be used as a software WebGL fallback.

Setting the policy to Disabled or not set, WebGL context creation may fail if hardware GPU acceleration is not available. Web pages may misbehave if they do not gracefully handle WebGL context creation failure.

This is a temporary policy which will be removed in the future.

true = Enable support for unsafe SwiftShader WebGL fallback
false = Disable support for unsafe SwiftShader WebGL fallback

• Chrome (Windows) since version 105

Encrypted ClientHello (ECH) is an extension to TLS to encrypt sensitive fields of the ClientHello and improve privacy.

If this policy is not configured, or is set to enabled, Samsung Browser will follow the default rollout process for ECH. If it is disabled, Samsung Browser will not enable ECH.

When the feature is enabled, Samsung Browser may or may not use ECH depending on server support, availability of the HTTPS DNS record, or rollout status.

ECH is an evolving protocol, so Samsung Browser's implementation is subject to change. As such, this policy is a temporary measure to control the initial experimental implementation. It will be replaced with final controls as the protocol finalizes.

true = Enable the TLS Encrypted ClientHello experiment
false = Disable the TLS Encrypted ClientHello experiment

• Chrome (Windows) since version 128

This policy controls a custom label used to identify managed profiles. For managed profiles, this label will be shown next to the avatar in the toolbar. The custom label will not be translated.

When this policy is applied, any strings that surpass 16 characters will be truncated with a “...” Please refrain from using extended names.

This policy can only be set as a user policy.

Note that this policy has no effect if the EnterpriseProfileBadgeToolbarSettings policy is set to hide_expanded_enterprise_toolbar_badge (value 1).

• Chrome (Windows) since version 139

This policy controls a custom label used to indicate a managed browser. For managed browsers, this label will be shown in a management disclaimer on a footer on the New Tab page. The custom label will not be translated.

Note that this policy is only applied for managed browsers, so it will have no effect for managed users on unmanaged browsers.

On Microsoft® Windows®, this policy is only available on instances that are joined to a Microsoft® Active Directory® domain, joined to Microsoft® Azure® Active Directory® or enrolled in Samsung Browser.

• Chrome (Windows) since version 71

Setting the policy to True lets extensions installed by enterprise policy use the Enterprise Hardware Platform API.

Setting the policy to False or leaving it unset prevents extensions from using this API.

Note: This policy also applies to component extensions, such as the Hangout Services extension.

true = Allow managed extensions to use the Enterprise Hardware Platform API
false = Do not allow managed extensions to use the Enterprise Hardware Platform API

• Chrome (Windows) since version 131

For work and school profiles, the toolbar will show a "Work" or "School" label by default next to the toolbar avatar. The label will only be shown if the signed in account is managed.

Setting this policy to hide_expanded_enterprise_toolbar_badge (value 1) will hide the enterprise badge for a managed profile in the toolbar.

Leaving this policy unset or setting it to show_expanded_enterprise_toolbar_badge (value 0) will show the enterprise badge.

The label is customizable via the EnterpriseCustomLabel policy.

0 = Show expanded enterprise toolbar badge
1 = Hide expanded enterprise toolbar badge

• Chrome (Windows) since version 106

If this policy is Enabled, the option to keep any existing browsing data when creating an enterprise profile will be checked by default.

If this policy is unset or Disabled, the option to keep any existing browsing data when creating an enterprise profile will not be checked by default.

Regardless of the value, the user will be able to decide whether or not to keep any existing browsing data when creating an enterprise profile.

This policy has no effect if the option to keep existing browsing data is not available; this happens if enterprise profile separation is strictly enforced, or if the data would be from an already managed profile.

true = Check the option to keep existing browsing data by default
false = Do not check the option to keep existing browsing data by default

• Chrome (Windows) since version 100

You can enable this policy to create a dictionary of file type extensions with a corresponding list of domains that will be exempted from file type extension-based download warnings. This lets enterprise administrators block file type extension-based download warnings for files that are associated with a listed domain. For example, if the "jnlp" extension is associated with "website1.com", users would not see a warning when downloading "jnlp" files from "website1.com", but see a download warning when downloading "jnlp" files from "website2.com".

Files with file type extensions specified for domains identified by this policy will still be subject to non-file type extension-based security warnings such as mixed-content download warnings and Safe Browsing warnings.

If you disable this policy or don't configure it, file types that trigger extension-based download warnings will show warnings to the user.

If you enable this policy:

* The file type extension entered must be in lower-cased ASCII. The leading separator should not be included when listing the file type extension, so list "jnlp" should be used instead of ".jnlp".

Example:

The following example value would prevent file type extension-based download warnings on "exe" and "jnlp" extensions for *.example.com domains, and on "swf" extensions for all domains. It will show the user a file type extension-based download warning on any other domain for exe and jnlp files, but not for swf files.

[
{ "file_extension": "jnlp", "domains": ["example.com"] },
{ "file_extension": "exe", "domains": ["example.com"] },
{ "file_extension": "swf", "domains": ["*"] }
]

Note that while the preceding example shows the suppression of file type extension-based download warnings for "swf" files for all domains, applying suppression of such warnings for all domains for any dangerous file type extension is not recommended due to security concerns. It is shown in the example merely to demonstrate the ability to do so.

If this policy is enabled alongside DownloadRestrictions, then the exemptions to file type extension-based warnings specified by this policy take precedence over a DownloadRestrictions setting that would block dangerous file types. The exemptions specified by this policy only apply to the "block dangerous file types" behavior specified by values 1 and 2 of DownloadRestrictions.

For example, if this policy specifies an exemption for "exe" downloads from "website1.com", and DownloadRestrictions is set to block malicious downloads and dangerous file types (value 1), then "exe" downloads from "website1.com" will be exempt from file type extension-based blocking but will still be blocked if they are malicious.

Windows (Windows clients):

Software\Policies\Samsung\Internet\ExemptDomainFileTypePairsFromFileTypeDownloadWarnings = [ { "domains": [ "https://example.com", "example2.com" ], "file_extension": "jnlp" }, { "domains": [ "*" ], "file_extension": "swf" } ]