The update, which is being shipped via the browser's automatic update mechanism, includes new features to patch third-party Firefox plug-ins and lock out rogue add-ons.
Building on the browser's ability to check for updates to Adobe Flash Player, Mozilla has now fitted a plug-in checker that scans the machine for insecure plug-ins that are installed. If an outdated plug-in is found, the browser will now prompt the user to apply the patch via a one-click interface.
Firefox users should keep in mind that plug-ins are different from add-ons or extensions. Many software products add plug-ins to Firefox without the user's knowledge or consent and these are rarely patched by the end-user.
Here is a link to the Firefox Plug-in Checker.
The second major security improvement in Firefox 3.6 is a behind-the-scenes tweak to lock out rogue Firefox add-ons. The feature is called Component Directory Lockdown, blocks browser add-ons from loading in the browser’s application components directory, a move that effectivly stops developers and software vendors from silently installing Firefox add-ons without explicit user permission.
It will also significantly reduce browser crashes linked to third-party add-ons, Mozilla said.
- Firefox to run checks for Adobe Flash patch
- Mozilla locks out rogue Firefox add-ons
- Firefox Flash patch nudge working, but...