![]() A temporary exception will be made for the most popular NPAPI plug-ins that are not already being blocked for security reasons in order to avoid disruption to users, he said. "Starting in January 2014, Chrome will block webpage-instantiated NPAPI plug-ins by default on the Stable channel," Schuh said. While click-to-play has been available in Chrome for several years, the feature has not been enabled by default, except for a number of plug-ins that Google considered to present a higher security risk, like Java, RealPlayer, QuickTime, Shockwave, Windows Media Player and Adobe Reader prior to Adobe Reader X. One month later it did the same for Chrome on Mac OS X. In August 2012, following two years of collaborative work with Adobe, Google switched the Flash Player plug-in bundled with Chrome for Windows from NPAPI to PPAPI. Google went even further and in 2010, the company started developing a new plug-in architecture called PPAPI (Pepper Plugin API) or simply Pepper, that forces plug-in code to run securely inside a sandbox and makes it less susceptible to crashes. Google, Mozilla and Opera responded to this threat by implementing click-to-play, an optional feature that prompts users for confirmation before executing plug-in based content. However, NPAPI's security shortcomings, like the fact that it spawns processes with privileged access to the underlying operating system, have in recent years led to a surge in attacks that exploit vulnerabilities in browser plug-ins to silently install malware on computers when users visit compromised or malicious websites.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |