The policy list (http://dev.chromium.org/administrators/policy-list-3) specifies RemoteAccessHostClientDomainList and RemoteAccessHostDomainList as ways to limit the list of domains that a Chrome remote desktop can connect to.

One would expect that if this policy is specified and no domain is given, the connection would not be made to any domain, but implementation ignores these cases and it's as if no policy is specified.

I think one of them needs update.