Feeds

Google Chrome will block out-of-date plug-ins

One-ups Mozilla

Security for virtualized datacentres

Google will soon prevent insecure versions of plug-ins from running on top of its Chrome browser to make sure they don't contain security bugs that can be exploited by malicious websites.

In a blog post, members of Google's security team said the feature, to be delivered "medium-term," will prevent Chrome from running "certain out-of-date plug-ins." It will also help users find updates.

The announcement comes a few months after anti-virus maker F-Secure said Adobe's Reader application replaced Microsoft Word as the program that's most often exploited in targeted malware campaigns, like the one that Google disclosed in January that exposed sensitive intellectual property. F-Secure said the increase is "primarily because there has been more vulnerabilities in Adobe Acrobat/Reader than in the Microsoft Office applications." Other plug-ins such as Adobe's Flash Player and Oracle's Java Virtual Machine are also routinely attacked.

The ability to run scores of browser plug-ins makes it hard for users to keep their systems fully patched. Mozilla recently addressed this problem by notifying users who run out-of-date add-ons on top of Firefox. Google seems to be going one step further by blocking them altogether.

"Since many plug-ins are ubiquitous, they pose the most significant risk to our user base," the Google employees wrote.

The auto-blocking will join several other security features being baked into Chrome. Chief among them is a home-grown PDF reader integrated into Chrome that sports its own security sandbox. This is now available in a developer build. The stable Chrome includes a built-in Flash plug-in that Google will automatically update via the browser's existing update mechanism, which does not ask for the user's approval.

Chrome has long boasted one of the most advanced sandbox designs, which thwarts attacks by running individual windows and plug-ins in a separate process with limited access to the operating system kernel. Chrome was the only browser at the recent Pwn2Own hacker contest that wasn't exploited. ®

Beginner's guide to SSL certificates

More from The Register

next story
Microsoft on the Threshold of a new name for Windows next week
Rebranded OS reportedly set to be flung open by Redmond
Business is back, baby! Hasta la VISTA, Win 8... Oh, yeah, Windows 9
Forget touchscreen millennials, Microsoft goes for mouse crowd
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple: SO sorry for the iOS 8.0.1 UPDATE BUNGLE HORROR
Apple kills 'upgrade'. Hey, Microsoft. You sure you want to be like these guys?
ARM gives Internet of Things a piece of its mind – the Cortex-M7
32-bit core packs some DSP for VIP IoT CPU LOL
Lotus Notes inventor Ozzie invents app to talk to people on your phone
Imagine that. Startup floats with voice collab app for Win iPhone
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.