Chrome puts NPAPI plugins on death watch

By the end of next year, Google intends to have removed all NPAPI-using plugins and apps from the Chrome ecosystem.

The Netscape Plugin API (NPAPI) architecture extends all the way back to Netscape Navigator 2.0, but, starting next year, Google will begin to phase out all plugins, apps, and extensions that make use of the interface.

From January 2014, Chrome will block "webpage-instantiated NPAPI plugins" as the default action, unless the plugin is on a temporary whitelist of the most used NPAPI plugins.

The plugins on the whitelist will be Silverlight, Unity, Google Earth, Google Talk, and Facebook Video. Even though Java is in the top five most popular plugins used, it will maintain its current status of being blocked for security reasons.

Google says that the above six plugins are the only NPAPI plugins that were used by more than 5 percent of users in the last month. IT administrators and users will be able to whitelist any other plugins that they wish.

Developers will be unable to submit any apps or extensions that contain NPAPI-based plugins to the Chrome Web Store from today. Any existing content is able to be updated until it is removed from the Web Store listing pages in May 2014. By September next year, Google says it will unpublish all Chrome Web Store content that uses NPAPI.

NPAPI support will eventually be removed from Chrome altogether, with the search giant saying that the final deadline will be set after gaining user feedback.

Any plugins that use Chrome's Pepper Plugin API (PPAPI), such as Chrome bundled Flash and PDF viewing implimentations, will be spared the axe.

Google is recommending that developers using NPAPI port their code to over one of Native Client, Packaged App, or Legacy Browser Support interfaces.

"Moving forward, our goal is to evolve the standards-based web platform to cover the use cases once served by NPAPI," wrote Justin Schuh, Google security engineer and plugin retirement planner, in a blog post.

Google cited performance issues, hangs, complexity, security issues, and lack of support on mobile devices as justification for the move to kill off NPAPI plugins.

Schuh also said that "Mozilla plans to block NPAPI plugins in December 2013"; however, the makers of Firefox are planning to make NPAPI plugins "Click to play" by default, instead of purging the browser of NPAPI as Chrome intends to do.

Firefox is slated to roll out its "Click to play" feature when Firefox 26 arrives in December this year.

Show Comments