Plugins #8
Description
NPAPI, PPAPI or ActiveX based web content renderers like: Adobe Flash Player, Unity, QuickTime Player, Java plug-in or Microsoft Silverlight
| Applications | NPAPI plugins | PPAPI plugins | ActiveX plugins | Flash plugin |
|---|---|---|---|---|
| Google Chrome 1-4 | enabled | N/A | N/A | NPAPI |
| Google Chrome 5-31 | enabled | enabled 1 | N/A | NPAPI, PPAPI |
| Google Chrome 32-41 | whitelisted 2 | enabled | N/A | PPAPI (embedded) |
| Google Chrome 42-52 | disabled 3 | enabled 4 | N/A | PPAPI (embedded) |
| Google Chrome 53-54 | N/A | enabled 5 | N/A | PPAPI (embedded) |
| Google Chrome 55-56 | N/A | enabled 5 | N/A | PPAPI (embedded), whitelist or click to play 6 |
| Google Chrome 57-58 | N/A | enabled 5 18 | N/A | PPAPI (embedded), whitelist or click to play 6 |
| Google Chrome 59 | N/A | ? | N/A | PPAPI (embedded), whitelist or click to play 26 |
| Google Chrome 60 | N/A | ? | N/A | PPAPI (embedded), whitelist or click to play 27 |
| Google Chrome 61 | N/A | ? | N/A | PPAPI (embedded), whitelist or click to play 27 28 |
| Google Chrome 62-67 | N/A | ? | N/A | PPAPI (embedded), whitelist or click to play 27 29 |
| Google Chrome 68-75 | N/A | ? | N/A | PPAPI (embedded), click to play 25 |
| Google Chrome 76-86 | N/A | ? | N/A | PPAPI (embedded), disabled by default 24 |
| Google Chrome 87+ | N/A | ? | N/A | N/A 23 |
| Mozilla Firefox 1-16 | enabled 20 | N/A | N/A | NPAPI |
| Mozilla Firefox 17-46 | whitelisted 7 20 | N/A | N/A | NPAPI |
| Mozilla Firefox 47 | disabled, except Flash 8 20 | N/A | N/A | NPAPI |
| Mozilla Firefox 48-51 | disabled, except Flash 8 20 | N/A | N/A | NPAPI, blacklisted 9 |
| Mozilla Firefox 52 (excl. ESR) | only Flash 10 20 | N/A | N/A | NPAPI, blacklisted 9 |
| Mozilla Firefox 53 (excl. ESR) | only Flash 11 20 | N/A | N/A | NPAPI, blacklisted 9 |
| Mozilla Firefox 55-? (excl. ESR) | only Flash 11 20 22 | N/A | N/A | NPAPI, click to play, blacklisted 9 21 |
| Mozilla Firefox 56 Android | N/A 33 | N/A | N/A | N/A |
| Mozilla Firefox ? (late 2018) (excl. ESR?) | only Flash 11 20 22 | N/A | N/A | NPAPI, click to play, blacklisted 9 21 34 |
| Mozilla Firefox ? (early 2019) (excl. ESR?) | only Flash 11 20 22 | N/A | N/A | NPAPI, click to play, blacklisted 9 21 34 35 |
| Mozilla Firefox ? (mid 2019) (excl. ESR?) | only Flash 11 20 22 | N/A | N/A | NPAPI, disabled by default 36 |
| Mozilla Firefox ? (2020) (excl. ESR) | N/A | N/A | N/A | N/A 37 |
| Mozilla Firefox ? (2021) | N/A | N/A | N/A | N/A 38 |
| Microsoft Internet Explorer 3-11 | N/A | N/A | enabled | ActiveX |
| Microsoft Internet Explorer 10 Windows 8 Metro Mode | N/A | N/A | disabled 19 | ActiveX, blocked |
| Microsoft Internet Explorer ? (2018) | N/A | N/A | ? | ActiveX 30 |
| Microsoft Internet Explorer ? (2019) | N/A | N/A | ? | ActiveX, disabled 31 |
| Microsoft Internet Explorer ? (end of 2020) | N/A | N/A | ? | N/A 32 |
| Microsoft Edge | N/A | N/A | N/A 13 | embedded |
| Microsoft Edge Build 14316 | N/A | N/A | N/A | embedded, click to play 14 |
| Microsoft Edge Build 15002 | N/A | N/A | N/A | embedded, click to play 15 |
| Microsoft Edge ? (late 2018) | N/A | N/A | N/A | embedded, click to play 15 |
| Microsoft Edge ? (2019) | N/A | N/A | N/A | embedded, disabled 31 |
| Microsoft Edge ? (end of 2020) | N/A | N/A | N/A | N/A 32 |
| Safari 1-9 desktop | enabled | N/A | N/A | NPAPI |
| Safari 10 desktop | enabled, click to play 16 | N/A | N/A | NPAPI, click to play 16 |
| Safari 12 desktop | only Flash 39 | N/A | N/A | NPAPI, click to play 16 |
1: Getting Started: Background and Basics - The Chromium Projects
2: non whitlisted plugins are blocked: Silverlight, Unity, Google Earth, Java, Google Talk, Facebook Video
See NPAPI deprecation: developer guide - The Chromium Projects
3: chrome://flags/#enable-npapi can be used to re-enable support of all NPAPI plugins.
See Chromium Blog: The Final Countdown for NPAPI
4: default "Detect and run important plugin content" option (can be changed to "Run all plugin content" and "Let me choose when to run plugin content"). Disable non "essential"/relevant/important content:
- same domain/origin as the page
- min 398 × 298 (annonced as 400 × 300), expected 5 × 5 and smaller, or undefined size
Plugin content outside viewport use click to play, except small content.
Display a message to reload the current page and enable plugins for that page.
See:
- Flash Roadmap - The Chromium Projects
- Google Chrome Blog: Better battery life for your laptop
- Intent to implement: Remove plugin exception for tiny content - Google Groups
- For anyone interested in the definition of "essential", see the source code: ht... | Hacker News
- Power Saver Plugin Throttle Event Timing - Google Groups
- content/renderer/pepper/plugin_power_saver_helper.cc - chromium/src.git - Git at Google
5: same as 4, but exception is only for 5x5 plugin content, from a same origin will block all the small, non-visible plugin elements on web pages (use intersection observer). If non-visible plugin objects are blocked, an icon in the address bar is displayed.
Except for 5x5 plugin content, from a same origin
See:
- Flash Roadmap - The Chromium Projects
- Flash and Chrome
- Intent to implement: Remove plugin exception for tiny content - Google Groups
- PPS tiny content suppression - design doc - Google Docs
6: enable flash only if the site engagement score is above a threshold or in the user whitelist (persmission)
If the site engagement score is ≥ 1. See chrome://site-engagement/
Does provide information about Flash in navigator.plugins and navigator.mimeTypes only he user has indicated that the domain should execute Flash, or if the site is in one of the Top 10 domains using Flash.
Except for small content (5×5 and smaller), hosted on the same origin
Option are changed:
- "Always run Flash content" = Never prompt
- (default) "Allow Sites to ask to run Flash content (recommended)" = Ask the first time only
- "Allow Sites to ask to run Flash content, let me choose when to run" = Right-click to play, always
- "Never run Flash content" = Disable the plugin entirely
chrome://flags/#prefer-html-over-flash can be used to re-enable non whitelist disable (block by heuristic)
- Flash Roadmap - The Chromium Projects
- HTML5 by Default - Google Slides
- HTML5 by Default - Archived Copy of Original Proposal - Google Slides
7: disabled plugins that aren't on whitelist (include Flash ≥ 10.2.*). Require a user action "Click to play"
See:
- Putting Users in Control of Plugins | Mozilla Security Blog
- Plugin Activation in Firefox | Future Releases
8: disabled all plugins except Flash ≥ 10.2.*. Require a user action "Click to play"
9: block (click-to-play) SWF using a blacklist
We categorized SWFs as fingerprinting SWFs if they were smaller than 5x5 pixels and called Flash's enumerateFonts() and ExternalInterface APIs to obtain a list of all fonts unique to the user’s machine. We categorized SWFs as "supercookie" SWFs if they were smaller than 5x5 pixels, called Flash’s SharedObject API, and contained the string "cookie"
10: drop support for all NPAPI plugins, except Flash. plugin.load_flash_only = false can be used to re-enable support of all NPAPI plugins.
- ECMS - Support status for Java and browser plug-in support
- Firefox 52 Nightly: plugin support (except Flash) dropped - gHacks Tech News
- Reducing Adobe Flash Usage in Firefox | Future Releases
- 1269807 – (npapi-eol) Remove support for all NPAPI plugins (except Flash)
- Plug-in support has been dropped other than Flash (Affecting) | Firefox Site Compatibility
11: drop support for all NPAPI plugins, except Flash. plugin.load_flash_only is removed (but "might work for some plugins in 53", see 1269807 – (npapi-eol) Remove support for all NPAPI plugins (except Flash))
12: -
13: no Java plugin support nor Sliverlight
- A break from the past, part 2: Saying goodbye to ActiveX, VBScript, attachEvent… - Microsoft Edge Dev BlogMicrosoft Edge Dev Blog
- Moving to HTML5 Premium Media - Microsoft Edge Dev BlogMicrosoft Edge Dev Blog
14: click-to-play for non-essential Flash elements
- For Edge (EdgeHTML 14) Windows 10 Creator’s Update
- Extending User Control of Flash with Click-to-Run - Microsoft Edge Dev BlogMicrosoft Edge Dev Blog
- Putting Users in Control of Flash - Microsoft Edge Dev BlogMicrosoft Edge Dev Blog
15: untrusted Flash content is blocked by default
16: block by default "Click to use". Does not provide information about Flash, Java, Silverlight, and QuickTime in navigator.plugins and navigator.mimeTypes
17: same as 5, but no more small (5x5) content exception
18: unable to disable plugin. chrome://plugins is removed
- 615738 - Deprecate chrome://plugins - chromium - Monorail
- Google removes Plugin controls from Chrome - gHacks Tech News
19: ActiveX plugins are disabled by default, unless the website use special X-UA-Compatible header or included in CV (Compatibility View) list. (Between September 2011 and March 2013)
- Developer guidance for websites with content for Adobe Flash Player in Windows 8 (Internet Explorer)
- Web Bug Track: Microsoft reverts their decision to block Flash by default in IE10!
20: disable addons using a blacklist
- Blocklisting - MozillaWiki
- Keep your Firefox healthy with a quick checkup — Mozilla
- Blocked Add-ons
- Add-ons that cause stability or security issues are put on a blocklist - Mozilla Support Community
21: click-to-play for all Flash elements
22: allow plugin content only from HTTP and HTTPS
23: Flash support removed
24: Flash disabled by default
25: non-persisted Flash activation settings
26: same as 6, but remove un-sized (0×0 or hidden) content exceptions
27: same as 6, but no same origin exceptions
28: remove "prefer HTML over Flash" from chrome://flags
29: unify Flash settings: on/off toggle
-
on: Prompting users to enable Flash Player on a per site basis
-
off: Flash Player blocked
30: "Internet Explorer will continue to allow Flash for all sites in 2018"
31: Flash disabled by default
32: Flash support removed
33: Flash support removed
- Plugin Roadmap for Firefox - Plugin | MDN
- 1381916 - Remove support for plugin (flash)
- How do I watch Flash videos with Firefox for Android? | Firefox for Android Help
- Firefox 56 for developer - Mozilla | MDN
34: non-persisted Flash activation settings
35: show a warning on sites that use Flash
36: Flash disabled by default
37: Flash support removed
38: Flash support removed (Adobe stop shipping security update for Flash, Firefox refuse to load the Flash plugin)
39: Removed support for running legacy NPAPI plug-ins other than Adobe Flash
See also
- WebAssembly - Wikipedia
- Plugin Roadmap for Firefox - Plugin | MDN
- Flash Roadmap - The Chromium Projects
- Plug-in (computing) — Wikipedia
- Google Chrome — Wikipedia
- Mortar Project - MozillaWiki
- js-ctypes - Mozilla | MDN
- Google Geo Developers Blog: Announcing deprecation of the Google Earth API
- Firefox Roadmap for Flash End-of-Life | Future Releases
- chromium/ppapi at master · adobe/chromium
- Pepper plugin implementation - The Chromium Projects
- Getting Started: Background and Basic - The Chromium Projects
- Internet Explorer Blocked ActiveX List | TechNet
- WebAssembly Migration Guide - Google Chrome
- Chromium Blog: Goodbye PNaCl, Hello WebAssembly!
- Flash Usage Trend - The Chromium Projects
- Blocking Flash, Shockwave, Silverlight controls from activating in Office Applications for Security:
- Blocking Flash, Shockwave, Silverlight control from activating in Office Application for Security - Microsoft Tech Community - 191729
- Flash, Silverlight, and Shockwave control blocked in Office 2016 - Office Support
- Le contrôle Flash, Shockwave et Silverlight seront bloqué dan le application Office 365, par mesure de sécurité
- Historical yearly trend in the usage of client-side programming languages, May 2018