id: os_password_autofill_disable
title: Disable Password Autofill
discussion: |
  Password Autofill _MUST_ be disabled.

  macOS allows users to save passwords and use the Password Autofill feature in Safari and compatible apps. To protect against malicious users gaining access to the system, this feature _MUST_ be disabled to prevent users from being prompted to save passwords in applications.
check: |
  /usr/bin/osascript -l JavaScript << EOS
  $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\
  .objectForKey('allowPasswordAutoFill').js
  EOS
result:
  string: 'false'
fix: |
  This is implemented by a Configuration Profile.
references:
  cce:
    - CCE-95249-9
  cci:
    - N/A
  800-53r5:
    - N/A
  srg:
    - SRG-OS-000095-GPOS-00049
  800-171r3:
    - 03.04.06
  cis:
    benchmark:
      - N/A
    controls v8:
      - 4.1
      - 4.8
  cmmc:
    - CM.L2-3.4.6
    - CM.L2-3.4.7
    - IA.L2-3.5.8
    - IA.L2-3.5.9
macOS:
  - '26.0'
tags:
  - none
  - cnssi-1253_moderate
  - cnssi-1253_low
  - cnssi-1253_high
mobileconfig: true
mobileconfig_info:
  com.apple.applicationaccess:
    allowPasswordAutoFill: false
