Feeds

Google Chrome will block out-of-date plug-ins

One-ups Mozilla

Beginner's guide to SSL certificates

Google will soon prevent insecure versions of plug-ins from running on top of its Chrome browser to make sure they don't contain security bugs that can be exploited by malicious websites.

In a blog post, members of Google's security team said the feature, to be delivered "medium-term," will prevent Chrome from running "certain out-of-date plug-ins." It will also help users find updates.

The announcement comes a few months after anti-virus maker F-Secure said Adobe's Reader application replaced Microsoft Word as the program that's most often exploited in targeted malware campaigns, like the one that Google disclosed in January that exposed sensitive intellectual property. F-Secure said the increase is "primarily because there has been more vulnerabilities in Adobe Acrobat/Reader than in the Microsoft Office applications." Other plug-ins such as Adobe's Flash Player and Oracle's Java Virtual Machine are also routinely attacked.

The ability to run scores of browser plug-ins makes it hard for users to keep their systems fully patched. Mozilla recently addressed this problem by notifying users who run out-of-date add-ons on top of Firefox. Google seems to be going one step further by blocking them altogether.

"Since many plug-ins are ubiquitous, they pose the most significant risk to our user base," the Google employees wrote.

The auto-blocking will join several other security features being baked into Chrome. Chief among them is a home-grown PDF reader integrated into Chrome that sports its own security sandbox. This is now available in a developer build. The stable Chrome includes a built-in Flash plug-in that Google will automatically update via the browser's existing update mechanism, which does not ask for the user's approval.

Chrome has long boasted one of the most advanced sandbox designs, which thwarts attacks by running individual windows and plug-ins in a separate process with limited access to the operating system kernel. Chrome was the only browser at the recent Pwn2Own hacker contest that wasn't exploited. ®

Security for virtualized datacentres

More from The Register

next story
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
'Windows 9' LEAK: Microsoft's playing catchup with Linux
Multiple desktops and live tiles in restored Start button star in new vids
iOS 8 release: WebGL now runs everywhere. Hurrah for 3D graphics!
HTML 5's pretty neat ... when your browser supports it
Mathematica hits the Web
Wolfram embraces the cloud, promies private cloud cut of its number-cruncher
Google extends app refund window to two hours
You now have 120 minutes to finish that game instead of 15
Intel: Hey, enterprises, drop everything and DO HADOOP
Big Data analytics projected to run on more servers than any other app
Mozilla shutters Labs, tells nobody it's been dead for five months
Staffer's blog reveals all as projects languish on GitHub
SUSE Linux owner Attachmate gobbled by Micro Focus for $2.3bn
Merger will lead to mainframe and COBOL powerhouse
iOS 8 Healthkit gets a bug SO Apple KILLS it. That's real healthcare!
Not fit for purpose on day of launch, says Cupertino
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.