Chrome 25 blocks sneaky add-ons
Google mimics move made by Mozilla more than a year ago for Firefox
Computerworld - Google on Friday said Chrome 25, now in development, automatically blocks browser add-ons installed on the sly by other software.
The measure mimics what rival Mozilla did for Firefox over a year ago.
Auto-blocking has already appeared in Chrome 25 for Windows on the "dev" channel -- Google's least-polished public version -- which debuted last month. By the browser's semi-regular release schedule, Chrome 25 will reach the final "stable" channel, and thus the bulk of users, in the second half of February 2013.
According to Peter Ludwig, a Chrome product manager, Chrome 25 will automatically disable any browser extensions silently installed by other software. Extensions previously installed by third-party software will also be barred from running.
Chrome users can switch on such extensions manually, or remove them from the browser and their PC.
Although Ludwig never used the word "security" in his Dec. 21 blog post, the change's provenance was clear.
"[Silent installation] was originally intended to allow users to opt-in to adding a useful extension to Chrome as a part of the installation of another application," Ludwig explained. "Unfortunately, this feature has been widely abused by third parties to silently install extensions into Chrome without proper acknowledgment from users."
Google was more than a year behind rival Mozilla in banning extensions installed behind users' backs. In Aug. 2011, Mozilla said Firefox 8 would automatically block browser add-ons installed by other software. Firefox 8 shipped three months later.
Add-ons bundled with third-party software had been a problem for Firefox users, who complained loudly when they found mysterious extensions on their computers.
A toolbar installed in Firefox alongside Skype, for example, caused so many crashes in Jan. 2011 -- 40,000 in only one week -- that Mozilla blocked the add-on after calling the Internet phone company a "repeat offender." In 2009, Microsoft silently slipped an add-on into Firefox that left browser users open to attack.
Google has also made other moves this year to lock down extensions. As of Chrome 21, which launched last July, the browser will not accept add-ons installed directly from websites, but only from the Chrome Web Store. Previously, any website could prompt a Chrome user to install an extension.
"Online hackers may create websites that automatically trigger the installation of malicious extensions," Google noted in a Chrome Help page that explained the new rules. "Their extensions are often designed to secretly track the information you enter on the web, which the hackers can then reuse for other ill-intended purposes."
That security measure has not been foolproof, however, as a Facebook-theme scam detailed by Webroot last week illustrated: The rogue add-on was placed on the Chrome Web Store, even though Google had said on the same Help page that, "We have started analyzing every extension that is uploaded to the Web Store and take down those we recognize to be malicious."
Chrome 25's dev version for Windows can be downloaded from Google's website.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, or subscribe to Gregg's RSS feed . His e-mail address is email@example.com.
- Workarounds to purge search bar from Firefox's new tab page are available
- Mozilla ships Firefox 31, adds search to new tab page
- Microsoft's IE steps back from the brink of irrelevance
- Firefox falters, falls to record low in overall browser share
- Firefox risks user backlash by adding search box to new tab page
- Google unseats Microsoft as the U.S. browser powerhouse
- Safari, Chrome push to mask URLs
- Chrome on Windows champs at the 64-bit
- Google pulls trigger, cripples some Chrome add-ons
- Microsoft shoots to shorten Internet Explorer's long tail
Read more about Internet in Computerworld's Internet Topic Center.
- Social Media Education: The New Edge for Success Failure to train for social media will cost your business money. A recent report showed how digitally prepared companies can unlock up to...
- Social Media in Technology: A Unified Strategy for Success Find out how social media is sparking a new era of customer and industry-understanding in technology enterprises and how industry leaders are overcoming...
- How Network Connections Drive Web Application Performance Users around the globe, on all sorts of devices, expect Web applications to function as seamlessly as desktop applications. This paper discusses the...
- Improving IT Efficiencies: Four Advantages of Multi-Tenant Data Centers Increasing demands on IT are forcing organizations to rethink their data center options. For many organizations, that means turning to the flexibility afforded...
- NSS Labs & Cisco Present: Evaluating Leading Breach Detection Systems Today's constantly evolving advanced malware and APTs can evade point-in-time defenses to penetrate networks. Security professionals must evolve their strategy in lockstep to...
- Will the Real Endpoint Threat Detection and Response Please Stand Up? This webinar explores new technologies & process for protecting endpoints from advanced attackers as well as the innovations that are pushing the envelope... All Internet White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!