|mogs||Chrome will block NPAPI plug-ins over stability, security concerns|
|24th Sep, 2013 21:41|
User Since: 22nd Apr, 2009
System Score: N/A
Chrome will block NPAPI plug-ins over stability, security concerns
Google plans to completely remove support for NPAPI plug-ins from Chrome by the end of 2014
By Lucian Constantin | 24 September 13
Plug-ins based on the NPAPI architecture will be blocked by default in Chrome starting early next year as Google moves toward completely removing support for them in the browser.
"NPAPI's 90s-era architecture has become a leading cause of hangs, crashes, security incidents, and code complexity," Justin Schuh, a Google Chrome security engineer, said Monday in a blog post. "Because of this, Chrome will be phasing out NPAPI support over the coming year."
First developed for Netscape, NPAPI (Netscape Plug-in Application Programming Interface) has long been the most popular plug-in architecture, supported by browsers like Mozilla Firefox, Google Chrome, Apple Safari, Opera and Konqueror.
However, NPAPI's security shortcomings, like the fact that it spawns processes with privileged access to the underlying operating system, have in recent years led to a surge in attacks that exploit vulnerabilities in browser plug-ins to silently install malware on computers when users visit compromised or malicious websites. Google, Mozilla and Opera responded to this threat by implementing click-to-play, an optional feature that prompts users for confirmation before executing plug-in based content.
Google went even further and in 2010, the company started developing a new plug-in architecture called PPAPI (Pepper Plugin API) or simply Pepper, that forces plug-in code to run securely inside a sandbox and makes it less susceptible to crashes.
Read more: http://www.pcadvisor.co.uk/news/security/3470452/c...