Detections
Analytics

2.93 L1 - Ensure 'Restrict Background Fetch API when called from a Service Worker' is set to 'Enabled'

Information

This setting dictates whether the Background Fetch API can be executed from a Service Worker context. Enabling this restriction prevents persistent background scripts from independently initiating, maintaining, or resuming large file downloads or data uploads after a user leaves the originating webpage.

Service Workers operate independently of open browser tabs, allowing them to execute background tasks silently. While the Background Fetch API is intended to gracefully handle large asset transfers (like video files or game data) across intermittent network states, it introduces distinct security and bandwidth exposure vectors in an enterprise environment.

Leaving this restriction disabled allows a compromised web origin or a malicious service worker to persistently pipe arbitrary or large data blocks out of the local workstation context without the user's awareness or visible browser interaction. Enforcing this policy shuts down a possible data exfiltration channel. It can also minimize background resource consumption by restricting file downloads to active and visible user sessions.

Solution

To establish the recommended configuration via Group Policy, set the following UI path to Enabled :

Computer Configuration\Policies\Administrative Templates\Google\Google Chrome\Restrict Background Fetch API when called from a Service Worker

Impact:

Any web tools that rely heavily on background syncing and asynchronous large-file downlinks will experience failures when trying to queue tasks outside an active tab. Users will need to keep the relevant web page or application tab open to complete large data downloads.

See Also

https://workbench.cisecurity.org/benchmarks/23110

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|AC-6(9), 800-53|AU-2, 800-53|AU-12, 800-53|SI-16, CSCv7|8.2, CSCv7|13.3

Plugin: Windows

Control ID: 495df7d2a1f103bdbcabf7eb2fa46be3dad25d8f818a2479d1c0a1e40d9f1286