Detections
Analytics

2.8.1 L2 - Ensure 'Allow Local Network Access (LNA) requests in subframes without explicit delegation' is set to 'Disabled'

Information

This setting controls whether nested cross-origin subframes (iframes) automatically inherit permissions to access the local network. Disabling this policy enforces a security perimeter. It also blocks embedded scripts from connecting to private IP addresses, loopback interfaces ( localhost ), or .local domains unless the parent webpage explicitly delegates that permission via the allow='local-network-access' code attribute.

Chrome's Local Network Access framework is built to stop public websites from acting as a bridge to scan or attack internal networks. Leaving this policy enabled lets nested, third-party iframes automatically inherit local network permissions from the parent site without explicit authorization. This creates a possible attack vector that could allow an untrusted or compromised embedded script to bypass firewall boundaries, map private subnets, or execute cross-site request forgery (CSRF) attempts against local corporate assets. Disabling this setting maintains a strict data boundary by ensuring subframes cannot communicate with local IP addresses or loopback services unless a developer explicitly allows it in the code.

Solution

To establish the recommended configuration via Group Policy, set the following UI path to Disabled :

Computer Configuration\Policies\Administrative Templates\Google\Google Chrome\Local Network Access settings\Allow Local Network Access (LNA) requests in subframes without explicit delegation

Impact:

Enabling this policy restriction may cause connection failures or broken functionalities in complex, multi-tenant enterprise web solutions. For those edge cases, organizations must update the underlying web application code to explicitly pass the allow='local-network-access' permission attribute down to the target subframe rather than relying on a global browser-level override.

See Also

https://workbench.cisecurity.org/benchmarks/23110

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|CM-8, 800-53|CM-8(1), 800-53|SI-8, CSCv7|7.1, CSCv7|12.1, CSCv7|12.4

Plugin: Windows

Control ID: b5311f2829956e2688aa5ec66eb99033fbfd4b669e2ea785f03acc091417db07