I have noticed that Firefox and Chrome have opened ports for unsolicited inbound traffic in the Windows firewall. This happened with Windows 7 x64 and Windows 10. (Here, I am talking about the standard firewall integrated in recent Windows versions, not some third-party product).
Normally, when a program tries to change the firewall configuration, I get a notification (dialog box) on the desktop asking me if I would like to allow that action. But with Firefox and Chrome, things are different:
I regularly delete all rules for Firefox and Chrome from the firewall configuration. However, each time those browsers update themselves (which is quite often), they re-create those rules without the usual confirmation dialog appearing.
I do not understand how this is possible. I currently suspect that the rules are recreated not by Firefox or Chrome themselves, but by their maintenance (update) services which are running in the background, probably with administrative rights.
I do not want Firefox to add rules to my firewall to let unsolicited inbound traffic pass to itself to any port from any address for TCP and UDP. Likewise, I do not want Chrome to add rules to my firewall which let unsolicited inbound UDP traffic pass to itself to a certain port, but also from any address. I am considering that a big security breach given the many security vulnerabilities of the browsers.
Hence the question: How do I prevent Firefox and Chrome and their maintenance / update services from silently adding rules to the Windows firewall?
I have seen that I could control the firewall by group policies, but this seems kind of extreme to me when the only reason would be the problem described above. My clients are not part of a domain, so I would have to do this on each of them. Furthermore, I am not sure if the browsers and their maintenance / update services are able to circumvent the group policies as well.
Steps to reproduce:
Open the GUI for the Windows firewall management ("Windows Firewall with advanced security")
On the left, select "Inbound rules"
A list of rules appears on the right; notice two rules whose name begins with "Firefox" and one rule whose name begins with "Chrome"
When you double-click one of the rules, a dialog box appears where the rule's properties, the ports being opened, the program which is allowed to receive that traffic and so on are detailed
Note that the two rules for Firefox are nearly identical; the only difference is that one is for TCP, the other for UDP. Both allow unsolicited inbound traffic from any address to any port to Firefox.
Note that the rule for Chrome lets pass UPD traffic from any address to port 5353 to Chrome.
Delete the three rules mentioned above
Wait until a Firefox update is available and install it
Note that the two rules for Firefox are re-created when installing the update without any confirmation dialog appearing
Wait until a Chrome update is available and install it
Note that the rule for Chrome is re-created when installing the update without any confirmation dialog appearing
Hint: When testing, please be aware that you might need to right-click on "Inbound Rules" at the left and select "Refresh" from the context menu to actually see the newest updates to the rules which might have been done in the background by services or applications.
Hint 2: In fact, if you want to test this, you don't need to wait for the next Firefox or Chrome update. Just install an old version of the browsers and make sure that the firewall rules mentioned above have been created, then delete those rules. Because you have installed old versions, updates will be available immediately. Install the updates and note that the firewall rules have been silently re-created.