How to Completely Disable ‘WebHID API’ via Group Policy in Microsoft Edge

The WebHID (Web Human Interface Device) API is a powerful Chromium specification that allows websites to communicate directly with HID-class peripherals connected to the local machine, such as game controllers, specialised keyboards, barcode scanners, or biometric readers. While designed for web-based configuration utilities and interactive hardware experiences, granting external web applications direct, low-level access to HID bus descriptors introduces a massive operational security (OPSEC) and peripheral exploitation liability in highly restricted enterprise, point-of-sale (POS), or zero-trust environments. A malicious or compromised website could silently enumerate connected HID devices, inject unauthorised keystroke payloads, or exfiltrate sensitive data from biometric readers by intercepting raw HID report descriptors.

This guide explains how to completely disable the ‘WebHID API’ via Group Policy in Microsoft Edge, enforcing a strict block that prevents all websites from requesting or initiating HID device communication.

Disable the WebHID API via Group Policy

To enforce a strict configuration that explicitly strips the Chromium hardware abstraction layer of its ability to broker WebHID API requests, overriding any user prompts or site permissions, we must deploy an administrative template.

1. Log into Windows with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > Microsoft Edge > Content settings

5. In the right-hand pane, locate the policy named Default WebHID guard setting (internally known as DefaultWebHidGuardSetting).
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Enabled.
8. Under the Options section, locate the dropdown menu labelled “Default WebHID guard setting”.
9. Explicitly select Don’t allow any site to request access to HID devices via the WebHID API (2). (By setting this integer value to 2, we instruct the Chromium rendering engine to proactively intercept and instantly reject any navigator.hid.requestDevice() API call, ensuring the browser refuses to enumerate or bind to local HID peripherals).
10. Click Apply, then click OK.

Verify the Configuration Lockdown

Group Policy changes modifying the Chromium hardware abstraction bridge require the browser to update its local policy state.

Close all active instances of Microsoft Edge. To force the policy update immediately across the OS, open Command Prompt as Administrator and run gpupdate /force. To verify the restriction is actively enforced, launch Microsoft Edge and navigate to edge://policy. Search for DefaultWebHidGuardSetting and confirm its value is set to 2. Furthermore, if you open the Developer Tools (F12) and attempt to invoke the HID API via the console with navigator.hid.requestDevice({filters:[]}), the browser will throw an immediate NotAllowedError, confirming total HID peripheral isolation from the web layer.