Back to Checks
googleworkspace

Scanning of linked images for malicious content is enabled

gmail_external_image_scanning_enabled
Service: gmailSeverity: medium
OfficialBuilt-inVerified
Categories:email-security
Resource Type:NotDefined

Gmail can scan images linked in email messages to detect malicious content. External images can be used to deliver tracking pixels, exploit browser vulnerabilities, or serve as part of phishing campaigns.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

Without external image scanning, attackers can use linked images to track email opens, deliver exploit payloads via image rendering vulnerabilities, or use images as part of sophisticated phishing schemes that mimic legitimate communications.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks gmail_external_image_scanning_enabled

Recommendation

Enable scanning of linked images so that Gmail proactively checks external image resources for malicious content before displaying them to users.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Gmail**
3Click **Safety** > **Links and external images**
4Check **Scan linked images**
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.gmail.gmail_client import gmail_client


class gmail_external_image_scanning_enabled(Check):
    """Check that scanning of linked images for malicious content is enabled.

    This check verifies that Gmail is configured to scan images linked
    in emails to detect and block malicious content hidden within
    external image resources.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if gmail_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=gmail_client.policies,
                resource_id="gmailPolicies",
                resource_name="Gmail Policies",
                customer_id=gmail_client.provider.identity.customer_id,
            )

            scanning_enabled = gmail_client.policies.enable_external_image_scanning

            if scanning_enabled is True:
                report.status = "PASS"
                report.status_extended = (
                    f"Scanning of linked images for malicious content is enabled "
                    f"in domain {gmail_client.provider.identity.domain}."
                )
            elif scanning_enabled is None:
                report.status = "PASS"
                report.status_extended = (
                    f"Scanning of linked images for malicious content uses Google's "
                    f"secure default configuration (enabled) "
                    f"in domain {gmail_client.provider.identity.domain}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Scanning of linked images for malicious content is disabled "
                    f"in domain {gmail_client.provider.identity.domain}. "
                    f"External image scanning should be enabled to detect hidden threats."
                )

            findings.append(report)

        return findings

References