Plugin-container.exe basically is Mozilla’s attempt of separating core plugins from being executed in the same process as the Firefox web browser. This is done foremost to improve stability. A plugin crash previously would have often causes the whole browser to crash as well. With plugins moved to plugin-container.exe the browser remains unharmed if a crash happens.

Back in 2010 Firefox used one instance of plugin-container.exe for the three plugins Adobe Flash Player, Microsoft Silverlight and Apple Quicktime.

Firefox users nowadays may see more than one instance of the plugin container process on their system and some may wonder why that is the case. The idea from the very beginning was to move core plugins into their own process eventually, and that’s what has been integrated into the browser now.

You can test it on your system easily. Make sure you have the Adobe Flash and Microsoft Silverlight plugin enabled. Visit YouTube and start watching a video to trigger the Flash plugin-container.exe. Now open a new blank tab and visit a site that uses Microsoft’s Silverlight technology to play videos. You will notice that plugin-container is launched twice and that the processes stay open when the video stops playing and even if the page is closed.

Not all plugins will be launched in their own plugin-container.exe process. If you launch a Java application you will notice for instance that it is not launched in its own plugin container process.

Firefox users can disable plugin-container.exe completely in the advanced configuration of the browser. Enter about:config in the address bar and hit enter. Now filter for the following term and set their values to false to disable the feature.

• dom.ipc.plugins.enabled

You can also disable separate processes for a specific supported plugin instead.

• dom.ipc.plugins.enabled.npctrl.dll (Microsoft Silverlight)
• dom.ipc.plugins.enabled.npqtplugin.dll (Apple QuickTime)
• dom.ipc.plugins.enabled.npswf32.dll (Adobe Flash)
• dom.ipc.plugins.enabled.nptest.dll (NPAPI test plugin)

Many Firefox users are reporting issues that they have with plugin-container.exe all over the Internet. What is your experience with Firefox’s out of process plugins?

I have disabled all those plugins and noticed a few months ago that Firefox sometimes re-enables those plugins automatically. When does it happen? I verified that plugins are automatically enabled whenever I switch Firefox versions. My main Firefox installation runs the latest Aurora build, but I have a stable version of Firefox installed on the same computer.

Yesterday I had to switch versions to check out Twitter’s implementation of Content Security Policy which has been only enabled for Firefox 4 versions and not the Aurora builds which are already listed as Firefox 5.

Today when I checked my plugins in Firefox 5 I noticed that they all had been re-enabled. To verify that the version switch was indeed the culprit I disabled all plugins again, closed Firefox 5, loaded and exited Firefox 4, and opened Firefox 5 again. The result? All previously disabled plugins were enabled again.

There may be additional circumstances where plugins are re-enabled automatically. Browser updates are one possibility. Please note that I have not verified this.

The core problem now is that there is no option available to users to block plugins from being installed in the browser. Well, that’s not entirely true but the controls are insufficient at best. See, you can disable plugin scanning, but this will remove already installed – and probably in use – plugins from the browser as well. So that is not really an option.

You can block some plugins either in the Windows Registry, if you use Windows, in the Firefox about:config configuration settings or by deleting plugins locally. All three methods have disadvantages.

Only some plugins can be blocked in the Registry by deleting their keys. While that’s nice and all, it is insufficient to resolve the issue with other plugins that still get re-enabled automatically. It is also likely that updates or new installations of programs that have added the plugins to the Registry in first place will re-add them there.

The Firefox about:config dialog holds options to block all plugin scans, or scans for Acrobat, QuickTime, SunJRE, and WindowsMediaPlayer. The latter can be blocked by changing the minimum version number requirement to a version that is not yet available, for instance 99. Look for plugin. scan.(Plugin-name) to find those plugins after entering about:config in the Firefox address bar. The description on the Mozilla help page seems to suggest that it is possible to add custom plugin names as a parameter, but that’s not explained anywhere on site.

Setting plugin.scan.plid.all to false blocks most plugin scans during startup of the browser.

Deleting plugins locally finally is an option, but those plugins are likely added again if the software that they are linked to is updated or re-installed. You can look-up the path of every active Firefox plugin by setting the parameter plugin.expose_full_path to true. The paths are then shown if you enter about:plugins in the Firefox address bar.

Your best bet currently is a mixture of all methods described above. But even if you manage to remove all plugins that you do not need, there is no guarantee that they won’t reappear later again.

Mozilla recently announced that they would make changes to the automatic integration of plugins in Firefox. This step is long overdue.

We leave it at that for the moment. Now, Firefox users end up with plugins installed that they have not added to the browser. On our test system those were for instance: (name, description)

• Google Update: Google Update
• Microsoft Office 2010: Office Authorization plug-in for NPAPI browsers
• Microsoft Office 2010: The plug-in allows you to open and edit files using Microsoft Office applications
• Quicktime Plug-In: The Quicktime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
• Silverlight Plug-In
• Windows Live Photo Gallery: NPWLPG

Other Firefox users will probably find other plugins there that have been installed automatically.

Plugins can be disabled in the Plugins manager, but not uninstalled or removed completely from the web browser. Entering about:plugins in the Firefox address bar will display additional information about each installed plugin. Users who visit the screen for the first time may want to type in about:config first, to change the preference plugin.expose_full_path to true. This displays the path to the plugin in the about:plugins dialog.

Displaying the path to the plugin does one thing: It enables the user to locate the plugin source on the hard drive. Just open the folder on the hard drive afterwards, backup the plugin file and delete it afterwards to remove it completely from Firefox. Here is how it is done for the two Microsoft Office 2010 plugins.

Locate the plugin paths in about:plugins and open the folders on the hard drive. In the case of Microsoft Office 2010, both plugins are located in the C:\Program Files (x86)\Microsoft Office\Office14\ folder on the hard drive (Please note, that the location on 32-bit systems is C:\Program Files\Microsoft Office\Office14\ instead).

The name of the first plugin is NPAUTHZ.DLL, the one of the second NPSPWRAP.DLL. We highly suggest to backup plugins before deleting them from the system, just in case they need to be restored at a later time. Plugins can be deleted while the browser is running, and doing so will immediately remove most of them from the about:plugins information window and the plugins manager in Tools > Add-ons. Some plugins may require a browser restart before they are completely removed from the browser.

To remove all plugins that are not used or needed simply go through the listing of plugins in about:plugins, locate the paths of those plugins on the hard drive, and backup and delete the plugin files.

There is also the possibility that some plugins have added themselves in the Windows Registry, Google Update comes to mind for instance. You can take a look at this guide How To Stop Automatic Plugin Installations In Firefox for an in depth walkthrough, or locate HKLM\Software\MozillaPlugins or HKLU\Software\MozillaPlugins in the Windows Registry to see if plugins have been added there as well. Again, export the Registry key first before deleting it, for the ability to restore the setting at a later time.

Regular Ghacks readers might already know the answer. Mozilla has added so called out-of-process plugins to the Firefox web browser. This feature runs specific Firefox plugins, like Adobe’s Flash Player, Quicktime or Silverlight, in their own process whenever they are needed to run elements on a web page (see Firefox 3.6.4 release announcement for additional information).

The plugin-container.exe process is that extra process that is launched whenever one of the supported plugins is started in Firefox.

plugin-container.exe

The process remains active once it has been started. It is for instance triggered when the Firefox user starts to view a Flash or Quicktime video and closed when Firefox is closed or its manually killed.

Mozilla currently uses one plugin container for all supported browser plugins. This is unlike Google Chrome where every plugin is launched in its own process. Future Firefox versions will be modified so that the plugins are run in their own process as well.

Check out Run Custom Firefox Plugins In Their Own Process to find out how to run additional plugins in Plugin-Container.exe instead of the main Firefox process.

Update: Plugin-Container.exe currently supports the following three popular plugins:

• Adobe Flash
• Apple Quicktime
• Microsoft Silverlight

Support is tied to plugin crash reports that Mozilla receives from user systems who have opted in to submit those information automatically whenever a plugin on the system crashes. New plugins may be added to the Plugin Container process if their crash rate increases significantly.

By default, only Silverlight, Flash and Quicktime are making use of this feature. Every other plugin is still running in the main Firefox process.

The developers have however created an option to add other plugins to the out-of-process plugins list so that they are run in their own process as well.

Custom out-of-process plugins

The first step of the process is to get the filename of the plugin, this can be done via about:plugins in the Firefox address bar.

firefox installed plugins

The plugin name of the Java plugin in the screenshot above is npjp2.dll. Just look at the File: reference to find the names of other plugins that are installed in the web browser.

Write down the names or open a new tab in Firefox and enter about:config into the address bar. This opens the Firefox configuration editor.

First time users need to get passed a warning message first before they can make changes.

A new boolean preference needs to be created for every plugin that should be run in its own process. This is done by right-clicking in the configuration window and selecting New > Boolean from the list.

This opens a form popup where the new parameter needs to be entered. The syntax is always the same; dom.ipc.plugins.enabled.Pluginname.

For Java it is dom.ipc.plugins.enabled.npjp2.dll.

out of process plugins

A second form is displayed right after the creation. Setting the value of the new parameter to true will enable out-of-process for the Java plugin.

boolean value

Firefox needs to be restarted before the changes take effect. Setting the value to false disables the feature again which can be helpful if a configured plugin is not running stable in its own process. (via Mozilla Links)

The feature was first introduced in the development release Firefox 3.6.3 Plugin 1 and has been carried over to the first beta release of Firefox 3.6.4.

The major feature of the beta is the out-of-process functionality. But the new version fixes several security and stability issues in Firefox 3.6.3 as well.

Firefox users running an earlier version of the Firefox 3.6.x branch might consider switching to the beta release because of the security issues that have been fixed. Bugzilla reports a total of 163 bugs that have been fixed in Firefox 3.6.4 Beta of which 2 have been rated as blockers and 13 as critical.

Many of the issues that have been fixed seem to be related to plugins and the new out-of-process plugins functionality. Interested Firefox users can take a look at the release notes for the full picture which also point to a download of Firefo 3.6.4 Beta.

The Mozilla developers have now released a beta version which they have called Firefox 3.6.3 Plugin 1 Lorentz. It is a beta release and therefor not available on the main site or through the Firefox automatic update checker.

The version that has been released is basically Firefox 3.6.3 with the Out-of-process plugin feature enabled.

The new feature currently supports the three popular plugins Adobe Flash, Apple Quicktime and Microsoft Silverlight. If those are installed they are running in their own process with the new release. The user will be notified about plugins crashing on the page where it happened. The page and the rest of the browser will continue to work as usual.

Firefox 3.6.3 Plugin 1 Lorentz can be downloaded from the Mozilla developer pages where it is available for all supported operating systems. Please note again that this is a beta release and should not be installed in a productive environment.

There are some configuration switches to block certain locations that are scanned for plugins whenever the Firefox web browser or the email client Thunderbird are started. The developer of plugin checker must have shared those reservations and decided to create an add-on that would inform the user of newly installed plugins.

Newly installed plugins – even if they have not been installed by the user – are automatically enabled in the web browser and email client. This can be a security risk among other things as there is no visual indication that a plugin has been added to the web browser. The only place to find out about that would be in the Plugins directory. But plugins are not marked as new even if they have been just added to the browser. This is different for extensions which are clearly marked as new in the web browser upon first startup after installation.

Plugin Checker will automatically display information about newly installed plugins after installation of the add-on. It does not offer a way to block them until the user enables them manually but the information that a new plugin has been installed can be used by the user to disable it afterwards.

Plugin Checker is available for Firefox and Thunderbird at the Mozilla website. It is a recommended add-on for both programs.

Update: The Plugin Checker add-on has been removed from the Mozilla Add-ons repository. Firefox users can use Mozilla’s official Plugin Check website to see if the browser plugins are up to date.

The majority of the blame should not be put solely on Microsoft though. Other software companies like Apple or Google have been doing exactly the same thing. Firefox users might notice a Google Update plugin or Apple iTunes plugin in the plugin section of the web browser. And those installations are not blocked by the Firefox browser.

There is however an option to block automatic plugin installations. It is not a perfect solution though but it is all that is provided currently. The Mozilla developers have added several directories and locations in the Firefox preferences that are automatically scanned by the web browser for plugins. If a plugin is found it will be added and activated in the browser.

These plugin directories are listed in the all.js files which is located in the greprefs directory of the Firefox installation. The following directories and locations are listed in the file (search for plugin or another word that will move the cursor to that position).

// Locate Java by scanning the Sun JRE installation directory with a minimum version
// Note: Does not scan if security.enable_java is not true
pref(“plugin.scan.SunJRE”, “1.3″);

// Locate plugins by scanning the Adobe Acrobat installation directory with a minimum version
pref(“plugin.scan.Acrobat”, “5.0″);

// Locate plugins by scanning the Quicktime installation directory with a minimum version
pref(“plugin.scan.Quicktime”, “5.0″);

// Locate and scan the Window Media Player installation directory for plugins with a minimum version
pref(“plugin.scan.WindowsMediaPlayer”, “7.0″);

// Locate plugins by the directories specified in the Windows registry for PLIDs
// Which is currently HKLM\Software\MozillaPlugins\xxxPLIDxxx\Path
pref(“plugin.scan.plid.all”, true);

// Controls the scanning of the Navigator 4.x directory for plugins
// When pref is missing, the default is to pickup popular plugins such as
// Flash, Shockwave, Acrobat, and Quicktime. If set to true, ALL plugins
// will be picked up and if set to false the scan will not happen at all
//pref(“plugin.scan.4xPluginFolder”, false);

As you can see there are entries for Sun Java, Adobe Acrobat, Apple Quicktime, the Windows Registry and Netscape plugins. Putting a comment in front of the plugin locations that should not be scanned will block those plugins from being started with Firefox (comments are added by adding // in front of a row).

Many Microsoft, Apple and Google plugins are added from the location in the Windows Registry. It is not advised to block that location completely as it also lists the Adobe Flash plugin in the Registry which would stop Flash support in the web browser. The only solution right now would be to go into the Registry and backup and remove the plugins that are not needed. If it were not for the Flash plugin the whole Registry location could be blocked from being scanned.

The programs will not add their plugins again to the Windows Registry unless they are updated or reinstalled. Another option to automatically block plugin installation (and display a prompt instead) is to use a software that will show a prompt before a specific Registry key is edited in Windows. A program like MJ Registry Watcher can do that. Simply add the HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins key to the list of keys protected by the program to be informed whenever a software tried to change or add entries to the key.

The following is a guide on how to remove the Windows Presentation Foundation plugin in the Firefox web browser for good. If the plugin would not be blacklisted it would be possible to find out about its dll files by typing in about:plugins in the web browser address bar.

The dll NPWPF.dll is the the Windows Presentation Foundation plugin. Here are the steps to remove it from the Firefox web browser (and other Mozilla products) for good:

• Close the Firefox web browser and every other Mozilla software that is running.
• Go to x:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\ in windows Explorer where x is the drive letter where Windows is installed on the computer system.
• Locate the file NPWPF.dll
• Create a backup of the file by copying it to another location, e.g. to c:\backups\
• Delete the dll NPWPF.dll in the Windows Presentation Foundation folder
• Restart the computer

Open Firefox after the restart. The Windows Presentation Foundation plugin should not show up in the list of installed plugins anymore. There is a second step that might be necessary. There is also a Registry entry for the plugin. Do the following to remove the plugin from there as well:

• Open the Windows Registry, press [Windows key R], type regedit and hit [enter]
• Locate the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins
• Locate the sub-key HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5
• Right-click the sub-key and select Export to backup the key before deleting it.
• Delete the key in the Registry
• Restart the computer system or kill and reload explorer.exe in Windows to load the Registry without the key.

This should get rid of the Windows Presentation Foundation plugin in Firefox for now.

The idea came up to extend this check to include other popular plugins as well. A first version of that plugin checker is now online and available at a test server which can be publicly accessed by anyone.

The scripts on the page will check for installed plugins and compare the version of the installed plugin with the latest version that is offered officially by the developer of the plugin. Supported are at the moment (among others) Apple Quicktime, Shockwave Flash, Adobe Acrobat, Java, RealPlayer and Windows Media Player plugins.

Plugins are either rated as safe or potentially vulnerable (there might be a third rating for vulnerable plugins). An update button is displayed next to potentially vulnerable plugins which should lead to a download page to update the latest version of the plugin. Some plugins do not reveal their full version which means that they will be shown as potentially vulnerable even if the latest version is installed.

Users who want to check out the Mozilla Plugin Check server right now can do so by visiting this link. They should know that the web browser will detect an invalid certificate and ignore it if they wish to continue. The plugin check website is working partially if other web browsers are used to connect to it.

The interface is tab driven and one of the tabs provides access to the list of plugins. You might be surprised about the amount of plugins listed on the page. Each plugin is either shown as enabled or disabled. The enabled plugins are highlighted while the disabled plugins are grayed out a bit to visualize the difference nicely.

A button to enable or disable the plugin is provided after clicking on a specific plugin. The amount of plugins shown in the menu might surprise some users who never looked into there before.

The test system contained plugins for iTunes, Google Update, Microsoft DRM, Java, Microsoft Office, Flash, Quicktime, Silverlight, Windows Genuine Advantage, Windows Media Player and Windows Presentation Foundation. That’s a lot of plugins of which most are probably superfluous.

The big question that I asked myself was if I really needed all those plugins. Before I could answer that question I had to find out which were installed. The command about:plugins in the address bar reveals all plugins currently loaded in Firefox. I discovered several plugins that I was not using for sure and some that I did not want to mess with.

An Adobe Reader plugin was still installed although I did uninstall the program a while ago. I discovered a Microsoft Office 2007 plugin, a Real Player plugin, AOL Media Playback plugin, Windows Presentation Foundation plugin and several more that I was pretty sure about that I did not need them.

The location of those plugins was mentioned in that menu as well which made it easy to track them down. I decided to move all plugins that I thought that I did not need anymore to a temporary location. This ensured that I would be able to move them back if I would discover that an application or website would need those plugins.

You should refresh the settings once you moved those plugins because sometimes other applications tend to take the place of those that you have removed.