Block Students misusing Bookmarklets

This article is written for Google Workspace for Education (GWFE) admins and educators.

What are bookmarklets?

A bookmarklet is a bookmark stored in a web browser that contains JavaScript commands that add new features to the browser. [source: Wikipedia]

Unlike the URL format of normal bookmarks which usually begins with https://, a bookmarklet prefixes with a javascript:. You can find the difference between a normal bookmark and a bookmarklet in this screenshot.

What can you do with bookmarklets?

As Javascript is a powerful programming language, bookmarklets can perform many operations on a webpage. An example is to embed a game on any webpage.

javascript:var frame = document.createElement('iframe'); frame.src="https://classic.minecraft.net"; frame.style.position="fixed"; frame.style.top="5%"; frame.style.right="0%"; frame.style.height="700px"; frame.style.width="1400px"; frame.style.zIndex="100000"; document.body.appendChild(frame); var btn= document.createElement("button"); btn.style.position="fixed"; btn.style.top="5%"; btn.style.right="25%"; btn.zIndex="100000"; innerHTML="HIDE"; document.body.appendChild(btn);

Another example is to modify a webpage. The change is only visible to yourself.

javascript:document.body.contentEditable = 'true'; document.designMode='on'; void 0

Bookmarklets can be also malicious. If you do not understand the Javascript language, do not copy and execute random bookmarklets you found online.

Why block bookmarklets for students?

Bookmarklets are too powerful to manage. Young students do not know what they are doing. They may find and use bookmarklets that allow them to play games, screw up school sites, or bypass school restrictions. Malicious code might destroy their school managed devices or steal sensitive information, causing security issues.

How to block bookmarklets?

Luckily, school managed Chrome browsers support block bookmarklets. Follow these instructions.

1. Sign into your Google Admin Console.
2. Go to Devices > Chrome > Settings.
3. Select your students' OU on the left panel.
4. Scroll to URL blocking.
5. Add this line javascript://*.
   
6. Click Save.

Yes, that's it. The change shall propagate to your students' Chrome browsers within 24 hours and their existing bookmarklets will no longer work.

You may also be interested in our Safe Doc product which help schools manage inappropriate features on Google Workspace for Education.