Chrome 25 blocks sneaky add-ons

Computerworld - Google on Friday said Chrome 25, now in development, automatically blocks browser add-ons installed on the sly by other software.

The measure mimics what rival Mozilla did for Firefox over a year ago.

Auto-blocking has already appeared in Chrome 25 for Windows on the "dev" channel -- Google's least-polished public version -- which debuted last month. By the browser's semi-regular release schedule, Chrome 25 will reach the final "stable" channel, and thus the bulk of users, in the second half of February 2013.

According to Peter Ludwig, a Chrome product manager, Chrome 25 will automatically disable any browser extensions silently installed by other software. Extensions previously installed by third-party software will also be barred from running.

Chrome users can switch on such extensions manually, or remove them from the browser and their PC.

Although Ludwig never used the word "security" in his Dec. 21 blog post, the change's provenance was clear.

"[Silent installation] was originally intended to allow users to opt-in to adding a useful extension to Chrome as a part of the installation of another application," Ludwig explained. "Unfortunately, this feature has been widely abused by third parties to silently install extensions into Chrome without proper acknowledgment from users."

Google was more than a year behind rival Mozilla in banning extensions installed behind users' backs. In Aug. 2011, Mozilla said Firefox 8 would automatically block browser add-ons installed by other software. Firefox 8 shipped three months later.

Add-ons bundled with third-party software had been a problem for Firefox users, who complained loudly when they found mysterious extensions on their computers.

A toolbar installed in Firefox alongside Skype, for example, caused so many crashes in Jan. 2011 -- 40,000 in only one week -- that Mozilla blocked the add-on after calling the Internet phone company a "repeat offender." In 2009, Microsoft silently slipped an add-on into Firefox that left browser users open to attack.

Google has also made other moves this year to lock down extensions. As of Chrome 21, which launched last July, the browser will not accept add-ons installed directly from websites, but only from the Chrome Web Store. Previously, any website could prompt a Chrome user to install an extension.

"Online hackers may create websites that automatically trigger the installation of malicious extensions," Google noted in a Chrome Help page that explained the new rules. "Their extensions are often designed to secretly track the information you enter on the web, which the hackers can then reuse for other ill-intended purposes."

That security measure has not been foolproof, however, as a Facebook-theme scam detailed by Webroot last week illustrated: The rogue add-on was placed on the Chrome Web Store, even though Google had said on the same Help page that, "We have started analyzing every extension that is uploaded to the Web Store and take down those we recognize to be malicious."

Chrome 25's dev version for Windows can be downloaded from Google's website.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, or subscribe to Gregg's RSS feed . His e-mail address is gkeizer@ix.netcom.com.

Read more about Internet in Computerworld's Internet Topic Center.