Chrome 25 blocks sneaky add-ons
Google mimics move made by Mozilla more than a year ago for Firefox
Computerworld - Google on Friday said Chrome 25, now in development, automatically blocks browser add-ons installed on the sly by other software.
The measure mimics what rival Mozilla did for Firefox over a year ago.
Auto-blocking has already appeared in Chrome 25 for Windows on the "dev" channel -- Google's least-polished public version -- which debuted last month. By the browser's semi-regular release schedule, Chrome 25 will reach the final "stable" channel, and thus the bulk of users, in the second half of February 2013.
According to Peter Ludwig, a Chrome product manager, Chrome 25 will automatically disable any browser extensions silently installed by other software. Extensions previously installed by third-party software will also be barred from running.
Chrome users can switch on such extensions manually, or remove them from the browser and their PC.
Although Ludwig never used the word "security" in his Dec. 21 blog post, the change's provenance was clear.
"[Silent installation] was originally intended to allow users to opt-in to adding a useful extension to Chrome as a part of the installation of another application," Ludwig explained. "Unfortunately, this feature has been widely abused by third parties to silently install extensions into Chrome without proper acknowledgment from users."
Google was more than a year behind rival Mozilla in banning extensions installed behind users' backs. In Aug. 2011, Mozilla said Firefox 8 would automatically block browser add-ons installed by other software. Firefox 8 shipped three months later.
Add-ons bundled with third-party software had been a problem for Firefox users, who complained loudly when they found mysterious extensions on their computers.
A toolbar installed in Firefox alongside Skype, for example, caused so many crashes in Jan. 2011 -- 40,000 in only one week -- that Mozilla blocked the add-on after calling the Internet phone company a "repeat offender." In 2009, Microsoft silently slipped an add-on into Firefox that left browser users open to attack.
Google has also made other moves this year to lock down extensions. As of Chrome 21, which launched last July, the browser will not accept add-ons installed directly from websites, but only from the Chrome Web Store. Previously, any website could prompt a Chrome user to install an extension.
"Online hackers may create websites that automatically trigger the installation of malicious extensions," Google noted in a Chrome Help page that explained the new rules. "Their extensions are often designed to secretly track the information you enter on the web, which the hackers can then reuse for other ill-intended purposes."
That security measure has not been foolproof, however, as a Facebook-theme scam detailed by Webroot last week illustrated: The rogue add-on was placed on the Chrome Web Store, even though Google had said on the same Help page that, "We have started analyzing every extension that is uploaded to the Web Store and take down those we recognize to be malicious."
Chrome 25's dev version for Windows can be downloaded from Google's website.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, or subscribe to Gregg's RSS feed . His e-mail address is email@example.com.
- Google reverses field, promises to restore Chrome's scrollbar arrows
- Update: Google ships Chrome 33, patches 28 bugs
- Mozilla's top exec defends in-Firefox ads, revenue search
- Mozilla taps in-Firefox ads as it searches for more revenue
- Mozilla ships Metro Firefox beta for Windows 8
- Mozilla defers Firefox's new 'Australis' UI to April
- Mozilla resets Metro Firefox ship date to mid-March
- Mozilla ships Firefox 26 with opening click-to-play move
- Mozilla banked $274M in '12 from Google-Firefox search deal
- Google trumpets Chrome's SPDY gains
Read more about Internet in Computerworld's Internet Topic Center.
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- IDC Report: The Future of eMail is Social This paper discusses the changing nature of collaboration and work fueled by the social Web by examining current email trends and the emergence...
- The Business of Social Business Social business represents a significant transformational opportunity for organizations. Read this whitepaper to learn more.
- Six Ways Your Small Business Can Save with Internet Phone Service Traditional phone systems present two main problems for businesses: limited features and high costs. As a result, small businesses are migrating to Internet...
- Cybersecurity Imperatives Reinvent Your Network Security With Palo Alto Networks The Rise of CyberSecurity
- Supercharge Your Web and Mobile App Development with High-Productivity Hybrid Cloud Webinar: Hear from industry experts about the amazing power at the intersection of next-generation web and mobile application development and cloud platforms.
- Webinar: Building a Big Data solution that's production-ready Big data solutions are no longer just a nice-to-have. All Internet White Papers | Webcasts