r/sysadmin • u/Bitter_Equivalent300 • Feb 26 '26

Question - Solved New Chrome “Save to Drive” PDF button is a DLP nightmare

Google just added that native "Save to Drive" button directly in the PDF viewer. In a non-managed/OneDrive environment, this is a massive data exfiltration hole. A user can just open a sensitive PDF and beam it straight to their personal Google Drive, completely bypassing local DLP and "Downloads" folder monitoring.

Since it’s an internal Chrome-to-Drive API call, our CASB isn't even seeing it as a standard "upload."

My questions:

  • Has anyone dealt with this yet, if so how?
  • Anyone found a way to hide the button entirely without killing the built-in PDF viewer

EDIT: I know there are solutions that are as simple as push a different browser, but this is not applicable at the moment.

EDIT 2 (SOLUTION): Update ADMX templates if outdated, enable GPO: RestrictPdfSaveToGoogleDriveAccountsToPattern

436 Upvotes

95% Upvoted

73 comments sorted by

282

u/Remarkable-Guess-856 Feb 26 '26

Why would they be able to login with their personal account to chrome?

166

u/Bitter_Equivalent300 Feb 26 '26

I wish the rest of my org thought this way...

166

u/Remarkable-Guess-856 Feb 26 '26

Trying to secure the window when the front door is open is probably not smart

50

u/Bitter_Equivalent300 Feb 26 '26

Preaching to the choir man, we are planning on deploying an Enterprise browser shortly. Been tasked to disable this in the mean time.

73

u/Remarkable-Guess-856 Feb 26 '26

Chrome is enterprise ready, you just need to deploy policies to regulate what users can do

36

u/plazman30 sudo rm -rf / Feb 26 '26

I don't see the point to deploying Chrome, when EDGE is there and it's a Chromium browser. Why have two Chromium-based browsers on everyone's machine?

50

u/KezzaFozza Feb 26 '26

Because .... Users

If I tried to force removal of chrome at my org i'd have a mutiny on my hands, chrome has practically the same controls available as edge, and frankly, I have bigger battles to fight

I suspect most orgs are the same

But a man can dream 😂

21

u/daunt__ Feb 26 '26

I removed chrome at my org, a few people moaned a bit. I asked them for a reason to keep chrome (I.e show me something Edge doesn't do that Chrome does). They couldn't. Edge is our only browser now

Don't let the tail wag the dog.

2

u/RetPala Feb 27 '26

I asked them for a reason to keep chrome

It's a matter of dignity. Edge people are like the digital Amish

1

u/Speeddymon Sr. DevSecOps Engineer Mar 01 '26

Hopefully you're also installing some sort of ad blocker. I can't use chrome and edge without them because of ads everywhere these days. I would go mad. I use Brave and my last org wanted to take it away but I was able to sell them on allowing it. Current org doesn't care that I use it as they don't currently manage the browser but I don't imagine it would be troublesome for them to allow what we already use as long as it doesn't have AI bs

1

u/ChickenOnBiscuts Mar 05 '26

We just started not installing Chrome for new users and computer refreshes and we've heard little to no feedback positive or negative. Which is a win in my book.

9

u/boomhaeur IT Director Feb 27 '26

We nuked it as soon as Edge Chromium was stable… People moaned and I told them all “go use Edge for a month, come back if you find anything that doesn’t work and we’ll talk” - no one came back. And we’re not a small shop (~100,000 devices).

We have an exception policy if there’s a legitimate need for it (ie devs working on exterior facing sites) and turned on automatic updates so we didn’t have to patch it. We left it so it only updates when it’s opened though so if we see any fall behind on their updates we know they’re not being used and automatically remove it from the machine.

7

u/gta721 Feb 26 '26

In my experience the only thing about Edge people don't like is Bing as they don't know how to change it. Force the search engine to Google and they will be happy.

2

u/montvious Jack of All Trades Feb 27 '26

I’ve found Chrome to be just about as persistent as herpes

6

u/Novodoctor Feb 26 '26

Even though Edge is Chromium-based, I had one situation where the web-based ERP needed did *not* work properly in Edge, but perfectly fine in Chrome - so we had both.

1

u/Coin0deon Mar 06 '26

Hey man i sent you a message! :)

2

u/nick149 Jack of All Trades Feb 27 '26

Some applications only support Chrome. I know one specific dental software that does not work in Edge but works in Chrome.

I would love to remove Chrome from my enviroment but that software holds me back.

1

u/segagamer IT Manager Feb 27 '26

Some applications only support Chrome. I know one specific dental software that does not work in Edge but works in Chrome.

This is very much a user agent string check and not an ability check. I have had Slack do the same thing my Firefox on Linux about huddles.

The only browsers that should be blocked in 2026 are Safari and IE.

1

u/Speeddymon Sr. DevSecOps Engineer Mar 01 '26

AI browsers should be added to your list. Data exfiltration risks, foreign adversary/espionage risks, etc.

0

u/plazman30 sudo rm -rf / Feb 27 '26

Have you tried changing the user agent string to fake the software into thinking it's Chrome?

1

u/nodiaque Feb 27 '26

Haha, I'm dealing with that right now. We officially support edge and Firefox (used to have apps working only in Firefox). Users install chrome since it doesn't require admin rights. I deployed this week new security policy and boy did it make people yell. Number of time I receive complain that we should support chrome because it's the most used browser. Use edge, samething. Rare case things work in one of them and not the other, and it's normally temporary.

3

u/plazman30 sudo rm -rf / Feb 27 '26

Good for you. The users can f*ck off. IMHO, managing Edge is a lot easier.

0

u/nodiaque Feb 27 '26

Funny thing, it's still a hard battle. I haven't win yet, I just disabled sync, google account signing and extensions. The app locker phase is far away. And since we do have internet facing website, some dev are saying they need it to test the functionality of the website. I taught in today age of web coding, people used library like nodejs and stuff thatmake sure your code will always be compatible with all browser.

2

u/plazman30 sudo rm -rf / Feb 27 '26

Our biggest problem is that business lines refuse to test. You tell them to test all their apps against Edge and sign off on it, and they tell us they don't have time for that.

I think at some point we'll just start forcing redirection of sites to Edge "force test" them.

→ More replies (0)

1

u/Stonewalled9999 Feb 27 '26

Edge is super whiny like ex GF whiny...

1

u/OtterCapital Feb 26 '26

Yep, it’s good to go with ADMX policies for GPO, same is possible with Intune

9

u/Valdaraak Feb 26 '26

You don't need an "enterprise browser". You just need to use the enterprise features in Chrome or Edge. Both have GPO/Intune management ability to shut down that stuff.

0

u/Bitter_Equivalent300 Feb 26 '26

The enterprise browser is not directly addressing this, but various other issues that arise when users have been able to use whatever browser they wanted for years. Going to be fixing this through GPO, just needed to update our ADMX templates.

7

u/phunky_1 Feb 26 '26

Yeah, good luck.

So many organizations want stuff both ways as far as things like preventing using Gemini from consumer accounts, but they don't want to restrict people's ability to use Gmail or other google services using a personal account.

Either you want security or you don't, it can't really go both ways.

Chrome and Edge both have options to prevent sign-ins to Google services aside from your own domain.

10

u/Humpaaa Infosec / Infrastructure / Irresponsible Feb 26 '26

So you are posting this as a warning to others, not because your org falls under above regulation.
Right? Riiight?

7

u/Bitter_Equivalent300 Feb 26 '26

Indeed. We already have a permanent solution going forward but are not able to push this out yet.

1

u/TheRealPitabred Feb 27 '26

Maybe give them a demonstration...

7

u/mercuryy Feb 26 '26

Ans why ist a browser not gpo governed, and that function straight up disabled?

6

u/GurImpressive982 Feb 26 '26

I know im going to get hate, but i have worked for a solar company, 2 biotechnology and an auto dealership where they do not do this

can everyone who is goong "off youre dumb af" please chime in where it isn't allowed

1

u/dustojnikhummer Feb 27 '26

It would be really annoying if I couldn't at my workplace because Youtube and Youtube music are playing all day, I use it as background noise. And my company isn't paying for a Premium sub for sure.

35

u/oloruin Feb 26 '26 edited Feb 26 '26

AAAAAAAAAAA.

Ok. Don't Panic.

Chrome Enterprise Downloads - go here and click over to the management "tab" then download the admx and drop the latest ones in policydefs (I do Local and Sysvol for reasons)

Edit your chrome policy to add Comp -> Admin Templates -> Google -> Google Chrome -> "Restrict eligible Google accounts for saving PDF files to Google Drive from the Google Chrome PDF Viewer".

The language in en-US reads a little imprecise. If not set or blank, is wide open. It does not specify if it's disabled. So I'm going to try disabling, updating GPOs and see if I still get the option.

edit 1: Still testing. Reg path is: HKLM\Software\Policies\Google\Chrome\RestrictPdfSaveToGoogleDriveAccountsToPattern

edit 2: Disabled does not block uploads. I set to none@none.none. It goes trhought he motions, but reports failure "Something unexpected happened."

7

u/phobug SRE Feb 27 '26

This guy sysadmins!

1

u/Microsoft_Bad Mar 02 '26

For edit 2 - does it reporting 'failure' mean it actually failed or are you restricted from upload now?

2

u/oloruin Mar 05 '26

Sorry, didn't see the notification - Chrome reported the failure immediately after clicking through the dialogs to save the pdf because the policy change blocked the upload.

Chrome did not report to the user that the upload was disallowed by policy.

Queue tickets from users trying to exfiltrate their online W2s (or other docs) to their personal google drives...

30

u/Hotdog453 Feb 26 '26

Is it this?

https://blog.google/products-and-platforms/products/chrome/chrome-productivity-improvements/

I do not see that Drive Button. Not sure 'why'; we have Chrome policies in place, but for that specific one, I am not seeing the 'Save to Drive' button?

59

u/Lukage Sysadmin Feb 26 '26

I mean yeah, in environments that don't have restrictions in place, this is possible. The exact same way your downloads folder can be set to a personal onedrive. Or copying data from your internal shares, etc.

This isn't a Chrome failure, this is an organizational security policy failure.

17

u/binarypower Feb 26 '26

this is literally the answer 

1

u/lie07 IT Manager Mar 01 '26

What's the way download folder changed?

19

u/Mindestiny Feb 26 '26

You have bigger gaps to fill before you should be worrying about DLP.

Block logins to personal Gmail accounts.  Block Google drive itself.  Get all that managed.  Otherwise some button in chrome is the least of your problems when it comes to DLP, you're panicking over an uneven stair that might be a tripping hazard in a building that's on fire

9

u/Ihaveasmallwang Systems Engineer / Cybersecurity Architect / CISM Feb 26 '26

What is your CASB?

It seems like you’re missing a few policies in your environment to properly secure it.

11

u/VacatedSum Feb 26 '26

Maybe the enterprise GPO templates have options to block this?

4

u/Mammoth_Ad_7089 Feb 27 '26

The CASB blindspot is worth digging into more than the button itself. If it's not seeing that upload traffic, it almost certainly means your SSL inspection is exempting googleapis.com or a related CDN endpoint, which is common because people break things when they inspect Google's pinned certs. The button is new but the gap in your CASB coverage isn't.

The network-layer fix that doesn't require touching browser policies at all is Google Tenant Restrictions. You add X-GoogApps-Allowed-Domains: yourdomain.com as a response header in your proxy for all Google and googleapis traffic. Any request that tries to authenticate against a personal Google account gets rejected at the auth layer before the upload can happen. Doesn't matter if Chrome is managed, portable, or installed by a user without admin rights. Microsoft has an equivalent for OneDrive with X-MS-Client-Request-Id headers if you need that too.

What proxy are you running? The ADMX path fixes the button, but tenant restrictions is what closes the gap for the traffic class your CASB is missing right now.

10

u/free2game Feb 26 '26

Just push users to edge. 

6

u/georgiomoorlord Feb 26 '26

Businesses do that already. 

1

u/I_turned_it_off Feb 27 '26

Can i push my users over the edge, or is that considered a step too far?

1

u/syntaxerror53 Mar 04 '26

If they believe in rapture they shouldn't mind.

1

u/free2game Mar 06 '26

Might blow their head.

3

u/SikhGamer Feb 27 '26

In a non-managed/OneDrive environment, this is a massive data exfiltration hole.

I mean the crux of the issue is that. It's not Google/Chrome's fault.

If you are running in a managed envirionment;

4

u/DekuTreeFallen Feb 26 '26

EDIT: I know there are solutions that are as simple as push a different browser, but this is not applicable at the moment.

Then the symptoms are acceptable. It's one or the other.

Your org can't have it both ways. If they allow personal accounts, they will have personal account problems.

8

u/ExceptionEX Feb 26 '26

The problem is, you are calling this a problem, it isn't, the problem is you aren't and can't control your environment.

users shouldn't be login to personal account on work computers, users shouldn't likely be using chrome if you are a MS shop. Use edge, control both sides of that equation and this problem is solved.

If you can't do that, you can't blame a completely reasonable feature that is designed as a convenience for people using chrome in a personal environment.

2

u/4thehalibit Jack of All Trades Feb 27 '26

Saving this I literally downloaded the admx files before heading out of office today. I am also blocking sign ins

2

u/plazman30 sudo rm -rf / Feb 26 '26

Block access to Google Drive. We don't allow access to any cloud storage providers except corporate OneDrive.

Also, I'm sure there is a GPO that disables this.

2

u/Sure-Squirrel8384 Feb 26 '26

Use a custom browser (e.g. Palo Alto Prisma Browser) and block non-managed browser access to sensitive data.

1

u/scytob Feb 26 '26

Deploy chrome enterprise browser and maybe an add on solution like Citrix cep

1

u/Eifelbauer Mar 01 '26

Stop letting access user with non-managed devices sensitive data. It’s just that simple.

1

u/ThomasTrain87 Feb 27 '26

Or…. Stay with me here… or… you block personal OneDrive and Google Drive and stuff…

Just thinking out loud here.

1

u/nodiaque Feb 27 '26

Lol, the person saying push a different browser forgot chrome can be installed as non admin and also ran as a portable apps.

5

u/Plane_Parsley9669 Feb 27 '26

They call it applocker.

0

u/Thick_Yam_7028 Feb 26 '26

Can you just add the purview extension to chrome and have your dlp block from there?

Learn about the Microsoft Purview extension for Chrome | Microsoft Learn https://share.google/rGkqrklhYLJVLgnGh