Skip to content

Plugins #8

Open
Open
Plugins#8

Description

@mems
mems
opened on Mar 13, 2017

NPAPI, PPAPI or ActiveX based web content renderers like: Adobe Flash Player, Unity, QuickTime Player, Java plug-in or Microsoft Silverlight

Applications NPAPI plugins PPAPI plugins ActiveX plugins Flash plugin
Google Chrome 1-4 enabled N/A N/A NPAPI
Google Chrome 5-31 enabled enabled 1 N/A NPAPI, PPAPI
Google Chrome 32-41 whitelisted 2 enabled N/A PPAPI (embedded)
Google Chrome 42-52 disabled 3 enabled 4 N/A PPAPI (embedded)
Google Chrome 53-54 N/A enabled 5 N/A PPAPI (embedded)
Google Chrome 55-56 N/A enabled 5 N/A PPAPI (embedded), whitelist or click to play 6
Google Chrome 57-58 N/A enabled 5 18 N/A PPAPI (embedded), whitelist or click to play 6
Google Chrome 59 N/A ? N/A PPAPI (embedded), whitelist or click to play 26
Google Chrome 60 N/A ? N/A PPAPI (embedded), whitelist or click to play 27
Google Chrome 61 N/A ? N/A PPAPI (embedded), whitelist or click to play 27 28
Google Chrome 62-67 N/A ? N/A PPAPI (embedded), whitelist or click to play 27 29
Google Chrome 68-75 N/A ? N/A PPAPI (embedded), click to play 25
Google Chrome 76-86 N/A ? N/A PPAPI (embedded), disabled by default 24
Google Chrome 87+ N/A ? N/A N/A 23
Mozilla Firefox 1-16 enabled 20 N/A N/A NPAPI
Mozilla Firefox 17-46 whitelisted 7 20 N/A N/A NPAPI
Mozilla Firefox 47 disabled, except Flash 8 20 N/A N/A NPAPI
Mozilla Firefox 48-51 disabled, except Flash 8 20 N/A N/A NPAPI, blacklisted 9
Mozilla Firefox 52 (excl. ESR) only Flash 10 20 N/A N/A NPAPI, blacklisted 9
Mozilla Firefox 53 (excl. ESR) only Flash 11 20 N/A N/A NPAPI, blacklisted 9
Mozilla Firefox 55-? (excl. ESR) only Flash 11 20 22 N/A N/A NPAPI, click to play, blacklisted 9 21
Mozilla Firefox 56 Android N/A 33 N/A N/A N/A
Mozilla Firefox ? (late 2018) (excl. ESR?) only Flash 11 20 22 N/A N/A NPAPI, click to play, blacklisted 9 21 34
Mozilla Firefox ? (early 2019) (excl. ESR?) only Flash 11 20 22 N/A N/A NPAPI, click to play, blacklisted 9 21 34 35
Mozilla Firefox ? (mid 2019) (excl. ESR?) only Flash 11 20 22 N/A N/A NPAPI, disabled by default 36
Mozilla Firefox ? (2020) (excl. ESR) N/A N/A N/A N/A 37
Mozilla Firefox ? (2021) N/A N/A N/A N/A 38
Microsoft Internet Explorer 3-11 N/A N/A enabled ActiveX
Microsoft Internet Explorer 10 Windows 8 Metro Mode N/A N/A disabled 19 ActiveX, blocked
Microsoft Internet Explorer ? (2018) N/A N/A ? ActiveX 30
Microsoft Internet Explorer ? (2019) N/A N/A ? ActiveX, disabled 31
Microsoft Internet Explorer ? (end of 2020) N/A N/A ? N/A 32
Microsoft Edge N/A N/A N/A 13 embedded
Microsoft Edge Build 14316 N/A N/A N/A embedded, click to play 14
Microsoft Edge Build 15002 N/A N/A N/A embedded, click to play 15
Microsoft Edge ? (late 2018) N/A N/A N/A embedded, click to play 15
Microsoft Edge ? (2019) N/A N/A N/A embedded, disabled 31
Microsoft Edge ? (end of 2020) N/A N/A N/A N/A 32
Safari 1-9 desktop enabled N/A N/A NPAPI
Safari 10 desktop enabled, click to play 16 N/A N/A NPAPI, click to play 16
Safari 12 desktop only Flash 39 N/A N/A NPAPI, click to play 16

1: Getting Started: Background and Basics - The Chromium Projects

2: non whitlisted plugins are blocked: Silverlight, Unity, Google Earth, Java, Google Talk, Facebook Video

See NPAPI deprecation: developer guide - The Chromium Projects

3: chrome://flags/#enable-npapi can be used to re-enable support of all NPAPI plugins.

See Chromium Blog: The Final Countdown for NPAPI

4: default "Detect and run important plugin content" option (can be changed to "Run all plugin content" and "Let me choose when to run plugin content"). Disable non "essential"/relevant/important content:

Plugin content outside viewport use click to play, except small content.

Display a message to reload the current page and enable plugins for that page.

See:

5: same as 4, but exception is only for 5x5 plugin content, from a same origin will block all the small, non-visible plugin elements on web pages (use intersection observer). If non-visible plugin objects are blocked, an icon in the address bar is displayed.
Except for 5x5 plugin content, from a same origin

See:

6: enable flash only if the site engagement score is above a threshold or in the user whitelist (persmission)

If the site engagement score is ≥ 1. See chrome://site-engagement/

Does provide information about Flash in navigator.plugins and navigator.mimeTypes only he user has indicated that the domain should execute Flash, or if the site is in one of the Top 10 domains using Flash.

Except for small content (5×5 and smaller), hosted on the same origin

Option are changed:

  • "Always run Flash content" = Never prompt
  • (default) "Allow Sites to ask to run Flash content (recommended)" = Ask the first time only
  • "Allow Sites to ask to run Flash content, let me choose when to run" = Right-click to play, always
  • "Never run Flash content" = Disable the plugin entirely

chrome://flags/#prefer-html-over-flash can be used to re-enable non whitelist disable (block by heuristic)

7: disabled plugins that aren't on whitelist (include Flash ≥ 10.2.*). Require a user action "Click to play"

See:

8: disabled all plugins except Flash ≥ 10.2.*. Require a user action "Click to play"

9: block (click-to-play) SWF using a blacklist

We categorized SWFs as fingerprinting SWFs if they were smaller than 5x5 pixels and called Flash's enumerateFonts() and ExternalInterface APIs to obtain a list of all fonts unique to the user’s machine. We categorized SWFs as "supercookie" SWFs if they were smaller than 5x5 pixels, called Flash’s SharedObject API, and contained the string "cookie"

— Firefox plugin blocklist

10: drop support for all NPAPI plugins, except Flash. plugin.load_flash_only = false can be used to re-enable support of all NPAPI plugins.

11: drop support for all NPAPI plugins, except Flash. plugin.load_flash_only is removed (but "might work for some plugins in 53", see 1269807 – (npapi-eol) Remove support for all NPAPI plugins (except Flash))

12: -

13: no Java plugin support nor Sliverlight

14: click-to-play for non-essential Flash elements

15: untrusted Flash content is blocked by default

16: block by default "Click to use". Does not provide information about Flash, Java, Silverlight, and QuickTime in navigator.plugins and navigator.mimeTypes

17: same as 5, but no more small (5x5) content exception

18: unable to disable plugin. chrome://plugins is removed

19: ActiveX plugins are disabled by default, unless the website use special X-UA-Compatible header or included in CV (Compatibility View) list. (Between September 2011 and March 2013)

20: disable addons using a blacklist

21: click-to-play for all Flash elements

22: allow plugin content only from HTTP and HTTPS

23: Flash support removed

24: Flash disabled by default

25: non-persisted Flash activation settings

26: same as 6, but remove un-sized (0×0 or hidden) content exceptions

27: same as 6, but no same origin exceptions

28: remove "prefer HTML over Flash" from chrome://flags

29: unify Flash settings: on/off toggle

30: "Internet Explorer will continue to allow Flash for all sites in 2018"

31: Flash disabled by default

32: Flash support removed

33: Flash support removed

34: non-persisted Flash activation settings

35: show a warning on sites that use Flash

36: Flash disabled by default

37: Flash support removed

38: Flash support removed (Adobe stop shipping security update for Flash, Firefox refuse to load the Flash plugin)

39: Removed support for running legacy NPAPI plug-ins other than Adobe Flash

See also

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions