Direct Launch of Browser Native Messaging Hosts (Google Chrome, Microsoft Edge)

Overview

Some browser extensions in Google Chrome and Microsoft Edge communicate with locally installed applications using Native Messaging. By default, Windows launches these native messaging hosts through cmd.exe before starting the target executable.

Because ThreatLocker Ringfencing commonly blocks browsers from interacting with cmd.exe to help prevent fileless attacks, certain browser extensions may fail to communicate with their required local applications.

ThreatLocker provides separate Configuration Manager policies for Google Chrome and Microsoft Edge that enable the browser to launch native messaging host executables directly, eliminating the dependency on cmd.exe while maintaining Ringfencing protection.

Configuration Policies

ThreatLocker includes the following Configuration Manager policies:

• Direct Launch of Browser Native Messaging Hosts for Google Chrome
• Direct Launch of Browser Native Messaging Hosts for Microsoft Edge

Enable the policy that corresponds to the browser(s) deployed in your environment. If your organization uses both Google Chrome and Microsoft Edge, enable both policies.

Why This Setting Is Needed

Many browser extensions rely on Native Messaging to communicate with locally installed software, including:

• Security agents
• Password managers
• Authentication and smart card software
• Device management software
• Other locally installed applications

By default, Chrome and Edge launch these native messaging hosts through cmd.exe. If browser access to cmd.exe is blocked, which is a common ThreatLocker Ringfencing configuration, the extension may fail to function.

When the appropriate Configuration Manager policy is enabled, the browser launches the target executable directly, allowing the extension to communicate with the application without requiring access to cmd.exe.

Benefits

• Allows Google Chrome and Microsoft Edge extensions to communicate with local applications without using cmd.exe.
• Maintains Ringfencing protection by keeping browsers blocked from launching cmd.exe.
• Improves compatibility with browser extensions that require Native Messaging.
• Avoids failures caused by Windows or system configurations that restrict or modify cmd.exe behavior.

When to Enable

Enable the appropriate policy if:

• A Google Chrome or Microsoft Edge extension cannot communicate with its required local application.
• The extension uses Native Messaging.
• Browser access to cmd.exe is intentionally blocked by ThreatLocker Ringfencing.

If your environment uses both browsers, enable both policies.

Security Considerations

Enabling these policies does not allow browsers to launch arbitrary command-line processes. Instead, they allow Google Chrome and Microsoft Edge to directly launch the executable defined in an extension's registered Native Messaging manifest, eliminating the need to use cmd.exe to interact with local applications.