How to Completely Disable ‘WebUSB API’ via Group Policy in Microsoft Edge

The WebUSB API is a web standard supported by Microsoft Edge that allows websites to request direct, low-level access to hardware devices connected to the user’s computer via Universal Serial Bus (USB). While this enables innovative web applications (such as browser-based firmware flashing tools or specialized 3D printer interfaces), it represents a catastrophic attack surface in strict enterprise, military, or zero-trust deployment environments. If a user is tricked into granting a malicious or compromised website access to a connected USB device (such as a hardware security key, a proprietary medical device, or an unvetted storage peripheral), the website can interface directly with the hardware, bypassing the operating system’s standard driver isolation and data loss prevention (DLP) controls.

This guide explains how to completely disable the ‘WebUSB API’ via Group Policy in Microsoft Edge, enforcing a strict zero-trust model where the browser is cryptographically prevented from establishing direct hardware bridges to connected USB peripherals.

Disable WebUSB API via Group Policy

To enforce a strict block that permanently neutralizes the WebUSB API within the browser rendering engine, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > Microsoft Edge > Content settings

5. In the right-hand pane, locate the policy named Control use of the WebUSB API.
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Enabled (Note: We enable the policy to configure a specific restriction state).
8. In the Options pane below, click the drop-down menu and select Block WebUSB (or the equivalent option to disable access). (By explicitly configuring this policy, we instruct the Edge rendering engine to permanently disable the navigator.usb JavaScript interface, ensuring web applications cannot query or connect to local hardware).
9. Click Apply, then click OK.

Verify the Configuration Lockdown

Group Policy changes require the browser to read the registry upon its next launch.

Close all active instances of Microsoft Edge. To force the policy update immediately across the OS, open Command Prompt as Administrator and run gpupdate /force. To verify the restriction is active, launch Microsoft Edge and navigate to edge://settings/content/usbDevices. The master toggle for “Ask when a site wants to access USB devices” will be completely greyed out and locked in the “Off” (Blocked) position. A briefcase icon alongside a message stating “This setting is managed by your organization” will be displayed. Any website attempting to invoke the WebUSB API will silently fail or receive a permission denied error. The browser is now cryptographically bound to a strict, hardware-isolated state.