Blocking Chromium WebAPK installs on managed devices: Chrome Managed Configuration + disable local app installs

Android

If you're using Google Chrome on your managed Android devices, users can bypass your app allowlist by installing Chromium WebAPKs directly from Chrome. This article explains how to prevent WebAPK generation by restricting the URLs Chrome can access and disabling local app installs.

Understanding the issue

When users visit Progressive Web App (PWA) sites in Chrome, the browser automatically generates and installs Chromium WebAPK packages (with names like org.chromium.webapk.*). Because Chrome installs these packages itself rather than through the Play Store, they bypass your app allowlist controls.

To prevent WebAPK generation, you need to restrict the URLs Chrome can visit and ensure local app installs are disabled.

Before you begin

• Google Chrome must be provisioned as a managed app in your Blueprint. Managed Configurations only apply to apps managed through Esper, not apps installed outside of Blueprint management.
• You should have access to the Esper Console with permissions to edit Blueprints.

Step 1: Apply Chrome URL restrictions

1. In the Esper Console, navigate to Blueprints and open the Blueprint applied to your target devices.
2. Go to the Apps & Configuration tab.
3. Locate Google Chrome in the app list.
4. Click the ellipsis (...) next to Chrome and select Managed Configuration.
5. Paste the following JSON into the Managed Configuration field, replacing the example URLs with your organization's approved sites:

   {
    "URLBlocklist": ["*"],
    "URLAllowlist": [
    "https://www.your-approved-site.com",
    "https://another-site.com"
    ],
    "HomepageLocation": "https://www.your-approved-site.com",
    "ForceGoogleSafeSearch": true
   }

6. Click Save.

"URLBlocklist": ["*"] blocks all URLs by default. Only URLs explicitly listed in "URLAllowlist" will be accessible. This prevents Chrome from loading PWA-capable sites and therefore prevents WebAPK generation.

Step 2: Disable local app installs

1. In the same Blueprint, under Apps & Configuration, locate the Allow Local App Installs toggle.
2. Confirm it is set to Off (disabled).

This closes the sideload install vector independently of the Chrome restriction.

Step 3: Publish and apply the Blueprint

1. Click Publish to save your changes.
2. Apply the updated Blueprint to your target device group.

Verify the configuration

On a test device, open Chrome and attempt to navigate to a non-allowlisted site. Chrome should display a blocked-page message. Try visiting a known PWA site (one that previously prompted "Add to Home Screen"). Confirm no WebAPK package matching org.chromium.webapk.* appears under Devices & Groups → [Device] → Apps in the Esper Console after several minutes.

Removing existing WebAPKs

If WebAPK packages are already installed on your devices, they will not be removed automatically by applying this configuration. To remove them:

1. Navigate to Devices & Groups → [Device] → Apps.
2. Find any packages matching org.chromium.webapk.*.
3. Select the package and click Uninstall.

Troubleshooting

Chrome continues to load blocked URLs: Confirm that Chrome is enrolled as a managed app in your Blueprint (not simply installed as unmanaged). Managed Configurations only apply to managed apps. If the issue persists, re-save and re-publish the Managed Configuration, as major Chrome version updates can occasionally require this.

You need unrestricted browsing but want to block WebAPK generation: There is no Android Enterprise policy that disables WebAPK installation specifically while permitting unrestricted browsing. You must restrict URLs to prevent WebAPK generation.

Managed Configuration keys reference: The URLBlocklist and URLAllowlist keys are Google Chrome policies, not Esper-specific settings. See the Chrome Enterprise Policy List for the complete policy reference.

Still need help?

If you're unable to prevent WebAPK generation or need additional assistance, contact Esper Support.