Chrome 25 blocks sneaky add-ons
Google mimics move made by Mozilla more than a year ago for Firefox
Computerworld - Google on Friday said Chrome 25, now in development, automatically blocks browser add-ons installed on the sly by other software.
The measure mimics what rival Mozilla did for Firefox over a year ago.
Auto-blocking has already appeared in Chrome 25 for Windows on the "dev" channel -- Google's least-polished public version -- which debuted last month. By the browser's semi-regular release schedule, Chrome 25 will reach the final "stable" channel, and thus the bulk of users, in the second half of February 2013.
According to Peter Ludwig, a Chrome product manager, Chrome 25 will automatically disable any browser extensions silently installed by other software. Extensions previously installed by third-party software will also be barred from running.
Chrome users can switch on such extensions manually, or remove them from the browser and their PC.
Although Ludwig never used the word "security" in his Dec. 21 blog post, the change's provenance was clear.
"[Silent installation] was originally intended to allow users to opt-in to adding a useful extension to Chrome as a part of the installation of another application," Ludwig explained. "Unfortunately, this feature has been widely abused by third parties to silently install extensions into Chrome without proper acknowledgment from users."
Google was more than a year behind rival Mozilla in banning extensions installed behind users' backs. In Aug. 2011, Mozilla said Firefox 8 would automatically block browser add-ons installed by other software. Firefox 8 shipped three months later.
Add-ons bundled with third-party software had been a problem for Firefox users, who complained loudly when they found mysterious extensions on their computers.
A toolbar installed in Firefox alongside Skype, for example, caused so many crashes in Jan. 2011 -- 40,000 in only one week -- that Mozilla blocked the add-on after calling the Internet phone company a "repeat offender." In 2009, Microsoft silently slipped an add-on into Firefox that left browser users open to attack.
Google has also made other moves this year to lock down extensions. As of Chrome 21, which launched last July, the browser will not accept add-ons installed directly from websites, but only from the Chrome Web Store. Previously, any website could prompt a Chrome user to install an extension.
"Online hackers may create websites that automatically trigger the installation of malicious extensions," Google noted in a Chrome Help page that explained the new rules. "Their extensions are often designed to secretly track the information you enter on the web, which the hackers can then reuse for other ill-intended purposes."
That security measure has not been foolproof, however, as a Facebook-theme scam detailed by Webroot last week illustrated: The rogue add-on was placed on the Chrome Web Store, even though Google had said on the same Help page that, "We have started analyzing every extension that is uploaded to the Web Store and take down those we recognize to be malicious."
Chrome 25's dev version for Windows can be downloaded from Google's website.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, or subscribe to Gregg's RSS feed . His e-mail address is firstname.lastname@example.org.
- Workarounds to purge search bar from Firefox's new tab page are available
- Mozilla ships Firefox 31, adds search to new tab page
- Microsoft's IE steps back from the brink of irrelevance
- Firefox falters, falls to record low in overall browser share
- Firefox risks user backlash by adding search box to new tab page
- Google unseats Microsoft as the U.S. browser powerhouse
- Safari, Chrome push to mask URLs
- Chrome on Windows champs at the 64-bit
- Google pulls trigger, cripples some Chrome add-ons
- Microsoft shoots to shorten Internet Explorer's long tail
Read more about Internet in Computerworld's Internet Topic Center.
- Capabilities You Need in an IP Address Management Solution A mismanaged IP space can cripple an otherwise healthy network. Take a moment to understand what you need in an enterprise-ready IPAM solution.
- IPv6 Fundamentals IPv6 is needed to sustain the growth of the Internet. The transition from IPv4 will require planning and likely some degree of support...
- 3G/4G Digital Signage Guide Today, the widespread availability of 3G and 4G cellular or wireless broadband networks enables digital signage to be deployed virtually anywhere.
- Enterprises in Motion: In-Vehicle Networks In a world where traditional tethers to the central office have all but vanished, enterprises that operate vehicle fleets require constant and dependable...
- Cloud BI in Action: Recorded Webinar of Customer, Kony, Inc. See how Kony, Inc., a leading enterprise mobility company, is using TIBCO Jaspersoft for Amazon Web Services and Redshift to achieve embedded analytics...
- Cloud BI Overview: Jaspersoft for AWS Check out this overview of Jaspersoft for AWS, to easily and affordably build business intelligence solutions as well as embed visualizations and analytics... All Internet White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!