Policy reference
NeX Browser uses standard Chromium policies, delivered from your admin panel. This page lists the ones that matter, and the pattern format that trips people up.
URL pattern format
URLBlocklist and URLAllowlist take patterns, not wildcards in the shell sense. Getting this wrong is the single most common mistake, because an invalid entry is simply ignored — the rule you thought you wrote never applies.
| Pattern | Matches |
|---|---|
example.com | example.com and every subdomain — mail.example.com too |
.example.com | exactly example.com, no subdomains |
https://example.com | that host over HTTPS only |
example.com:8080 | that host on that port |
example.com/reports | that path and everything under it |
chrome://* | every internal browser page |
* | everything |
*.example.com is not valid and will be ignored. A leading *. is not part of the format. Write example.com — it already covers every subdomain.
Policies
URLBlocklist
Addresses employees may not open.
A list of URL patterns. Anything matching is blocked, and the employee sees “Your organization doesn’t allow you to view this site”. Use * to block everything and then open specific addresses with URLAllowlist.
["*", "chrome://flags", "earth.google.com"]URLAllowlist
Exceptions to the blocklist.
Same pattern format as URLBlocklist, and it wins wherever both apply. The more specific pattern decides, so a blanket * block plus a short allowlist is the usual way to run a closed browser.
["chrome://*", "https://intranet.example.com", "example.com"]HomepageLocation
The page the home button opens.
A full URL, including the scheme. It must be a real address — about:blank is rejected, and the policy will report Error on nex://policy rather than applying. To make the home button open a blank new tab, set HomepageIsNewTabPage to true instead and leave this unset.
"https://intranet.example.com/"HomepageIsNewTabPage
Use the new tab page as the homepage.
When true, the home button opens a new tab and HomepageLocation is ignored.
ExtensionInstallBlocklist
Extensions employees may not install.
A list of extension IDs, or * to block everything not named in ExtensionInstallAllowlist.
ExtensionInstallAllowlist
Extensions that stay available.
Extension IDs that remain installable even when the blocklist would otherwise cover them.
Checking what applied
Open nex://policy in NeX Browser. Every policy the machine received is listed with its value and a status. OK means it applied; Error means the value was rejected and the policy is doing nothing.
Policy changes reach a running browser within about a minute — there is no need to restart it.