Chrome WebAPK installs bypass app allowlist — block with Managed Configuration

Android

When Google Chrome is installed on a managed Android device, users can visit Progressive Web App (PWA) sites and trigger Chrome to silently generate and install Chromium WebAPK packages, bypassing your app allowlist entirely.

Why this happens

Chrome installs WebAPK packages (named org.chromium.webapk.*) directly through the browser rather than through the Play Store, so Esper's allowlist controls never intercept them. Preventing WebAPK generation requires two independent controls: restricting which URLs Chrome can load, and confirming that local app installs are disabled on the device.

Before you begin

Google Chrome must already be provisioned as a managed app in the Blueprint applied to your target devices. Managed Configuration only applies to apps under Blueprint management.
Your Esper Console account must have permission to edit and publish Blueprints.

Step 1: Apply a URL restriction policy to Chrome

In the Esper Console, navigate to Blueprints and open the blueprint applied to your target devices.
Select the Apps & Configuration tab.
Locate Google Chrome in the app list, click the ellipsis (...) next to it, and select Managed Configuration.
Paste the following JSON into the Managed Configuration field, replacing the example URLs with your organization's approved domains:
```
{
  "URLBlocklist": ["*"],
  "URLAllowlist": [
    "https://www.your-approved-site.com",
    "https://another-approved-site.com"
  ],
  "HomepageLocation": "https://www.your-approved-site.com",
  "ForceGoogleSafeSearch": true
}
```
"URLBlocklist": ["*"] blocks every URL by default. Only domains explicitly listed in "URLAllowlist" are reachable, which prevents Chrome from loading PWA-capable sites and stops WebAPK generation at the source.
Click Save.

Step 2: Confirm local app installs are disabled

In the same blueprint, remain on the Apps & Configuration tab and locate the Allow Local App Installs toggle.
Confirm the toggle is set to Off. This independently blocks sideloaded installs regardless of how a package is delivered, and provides a second layer of protection beyond the Chrome URL restriction.

Step 3: Publish and apply the blueprint

Click Publish to save and activate your changes.
Confirm the updated blueprint is applied to your target device group. If it is not, apply it now from Blueprints and select the appropriate group.

Remove WebAPKs already installed on devices

Applying this configuration does not automatically uninstall WebAPK packages that are already present. To remove them manually:

Navigate to Devices & Groups → [Device Name] → Apps.
Search for any packages matching org.chromium.webapk.*.
Select each package and click Uninstall.

Verify

Verify: On a test device, open Chrome and attempt to navigate to a URL that is not in your allowlist — Chrome should display a blocked-page message. Then visit a known PWA site from your allowlist and confirm no new org.chromium.webapk.* package appears under Devices & Groups → [Device Name] → Apps within 5 minutes. If the toggle and Managed Configuration are both applied correctly, no new WebAPK packages should be generated.

If this doesn't resolve it

If WebAPK packages continue to appear after publishing the blueprint, collect the following before contacting support:

A screenshot of the Managed Configuration JSON as saved in the Esper Console.
The exact package names of any new org.chromium.webapk.* entries visible under Devices & Groups → [Device Name] → Apps.
The Chrome version installed on the affected device (visible under Devices & Groups → [Device Name] → Apps → Google Chrome).
Confirmation of whether Allow Local App Installs shows as Off in the applied blueprint.

Contact Esper Support with these details.

Still need help?

If you're still experiencing issues with Chrome WebAPK installs bypassing your app allowlist despite implementing Managed Configuration, please submit a support ticket and include your device model, Android version, and details about which WebAPKs are bypassing your allowlist policies.