Chrome 42 blocks Java, Silverlight, other plugins by default now
Google pushed out an update to the stable channel of its browser Chrome yesterday that brought the version of the browser to 42.
With it comes the second phase of a major change in regards to how plugins are handled by the browser.
If you follow Ghacks you know that Google made the decision to phase out so-called NPAPI plugins in the Chrome browser and Chromium this year.
NPAPI plugins use an old plugin API from the Netscape days. Java, Silverlight and other popular technologies use this API to integrate into browsers such as Chrome or Firefox.
Chrome supports a new API, called PPAPI, which is not affected by this move at all. Adobe Flash uses the new API in Chrome for example.
Google in the first phase blocked plugins from running in Chrome but allowed users to re-enable them directly in the browser.
This direct option has been removed in phase two.
Chrome users can still override the blocking of plugins in Chrome:
- Type chrome://flags in the browser's address bar and hit enter.
- Search for chrome://flags/#enable-npapi on the page. Or, load it directly.
- Enable it with a click on the link.
- Restart the browser.
All NPAPI plugins installed in Chrome become available again.
The second option to enable plugins for the time being is to use policies. You need to install Chrome Policy Templates first to enable that functionality.
Once done, do the following:
- Find "Specify a list of enabled plugins" in the root listing of the newly installed policy template.
- Double-click on the entry to open up its configuration.
- Set it to enabled.
- Click on Show next to "list of enabled plugins".
- To enable all, add the value * to the first field and click ok. This is a wildcard that indicates that all plugins should be enabled.
- Alternatively, add a plugin name as a value, e.g. Java or Shockwave Flash.
Check out this page for additional details and information about Registry keys.
Please note that both methods cannot be used after September 2015 when NPAPI plugins are disabled permanently in Chrome.
What happens if you want to access contents that require NPAPI plugins?
All content that requires NPAPI plugins won't be loaded in Chrome anymore. The browser won't throw an error message or suggestions to install plugins but the site you are on might.
You may get an install prompt instead of the actual content or an error message. That depends solely on the site you are accessing though and not anymore on the Chrome browser.
What can you do if you require plugins that Chrome does not support?
There are only two options that you have of which only one seems reasonable:
- Switch to another web browser that supports these plugins.
- Don't update Chrome to stay on a version that supports plugins.
It is unclear as of right now if Chromium-based browsers such as Opera or Vivaldi will follow Google Chrome by permanently blocking NPAPI plugins.
At least the two browsers mentioned support plugins right now and have not implemented the initial blocking of plugins.
It is likely therefore that plugins will remain accessible in those browsers for the time being. Considering that they share much of their architecture with Chrome, they may be a good choice for users who need to use another browser to access plugin contents.
How to find out which plugins are available in Chrome?
There is no button or menu item that you can click on Chrome's interface to display the list of plugins. What you need to do is load chrome://plugins/ directly in the browser.
There you find listed all plugins the browser recognizes. Disabled plugins are shown with a grey background while enabled ones with a white background.
A click on the enable or disable link underneath a plugin listing changes its state in the browser. If you are running Chrome 42 or later and have not re-enabled NPAPI plugin support, you will only see native PPAPI plugins listed on that page.
I wish Google would make it so no plugins could install in Chrome. I never liked Silverlight and I stopped installing Java 10 years ago.
If you don’t want them installed…. then…. well…. don’t install them…
Why would you want a program to determine what you can and can’t do?
My God, this. If anything, this is just more nanny-state run amok nonsense. I get the why, which is protect dumber people from themselves, and that is likely a good recipe for success: catering to most. In turn, this in theory could lead to less infestation of crap because no longer can Uncle Bob install 10 different browser toolbars from “legit looking” sites, and will not fall prey to arbitrary execution of malicious code drive-by style. OK, fine.
But I don’t agree at all with Chrome saying *I* can’t run Silverlight. So thankfully they aren’t making us abandon this browser yet, and we can still re-enable it if we feel like it. Edit: Or until September of 2015. Does google like to take useful things away or something?
There will always be power-users who are knowledgeable enough to navigate the swiss cheese that is Internet security without ending up spamming their whole contact list with viagra ads. Hell, I don’t even use a resident antivirus on my home system anymore (though I do run Malwarebytes free now and then, always clean). And if by some dumb luck I fall for some drive-by code execution scheme, no big deal. I make weekly backups of my C drive. Yeehaw.
And excellent article, thanks again Martin.
Very Good Article…
Well bully for you. Some of us are actual USERS, and we have no choice about what plugins various websites use.
This should be the user’s choice. I don’t like it when a browser starts to make security decisions in my name.
This applies to Windows OS as well. I don’t like Microsoft to make security decisions in my name. :-)
Well, if you ask me I would apply the same concept to an OS too :) Software (OS, browser, etc.) must offer the users all the security facilities they need, but must also allow the users the choice to enable or disable those security measures.
Specially when my bank runs a custom java plugin to boost security, without which I cannot access my internet banking. Now I have to install firefox or IE to access my bank account just because Google decided Chrome was not good enough. Kind of a backfire.
Had to laugh about a custom java to boost security. Java, Flash, and Silverlight have all had their embarrassment moments. Especially Java.
Seriously people, a strong default position is what Google is trying to accomplish. If you want Java or Silverlight to run in Chrome, by all means follow the directions above and let it rip. For those who don’t understand computer security or don’t want to fiddle with security settings, a strong default position is better than a weak one.
That’s the final straw for me. First Chrome has become really slow to load and uses a lot of resources. Now they have decided that I can’t use one of my essential uses Silverlight (I clock in and out on my company PC in the web browser which uses the Silverlight engine. IT want me to use IE.). I can’t be bothered in using this browser to do this and that browser to do that. So I will be using Firefox from now on which is not displaying this contempt. I do understand that Chrome is more than just a browser in that you can run apps, but come on Google. You pushed me out.
You can use IE Tab. It will activate Silverlight within Chrome. https://chrome.google.com/webstore/detail/ie-tab/hehijbfgiekmjfkfjpbkbammjbdenadd?hl=en-US
LOL, now years later. They block something which makes no sense. – We already have click-to-play. And remember that Silverlight is already dead and will be closed as soon as the lifetime cycle gets and ending.
About Java, it isn’t that insure anymore, since it gets regular updates, but people are just to lazy to update or not use the internal updater service.
I don’t see any reasons to block it, it just only shows again that Google want to control the internet and that they block other company’s. That’s why I never support such thing, controlling everywhere.
We don’t have ‘click-to-play’ anymore though.
1. Google does something.
2. Mozilla does it.
…can’t wait :/
Another thing Chrome 42 does is enable the new bookmarks system, “enhanced bookmarks”. For those that hate it as much as I do, to restore the old bookmarks system:
go to: chrome://flags/
set “enable enhanced bookmarks” to ‘disabled’
thanks, now i can dis able this, hugs and smooches
todays date: 4-15-15)
ok, i have windows 7 64bit,home premium. today when my google chrome updated too version 42.0.2311.90 m.
these plugins no longer appear in its plugin list.
wide vine, vlc, java, silverlight, foxit reader plugin, google earth plugin, photo gallery, google update, unity player, google talk.
i did find something today to tell me how to temporally re-enable this, now they all are showing up,
i also know that in September 2015, that in the next version of google chrome(in September) i wont be able to re-enable them again ever.
how ever, for the moment, firefox has them all listed in its plugin list and they work.
Unfortunately in my case…we use Chrome but we MUST have JAVA….
We are an Amazon seller…and we use Amazon’s tools to print shipping labels to a Zebra Label Printer directly from their Webpage…
Guess what….those tools are JAVA apps….
So we had about an hour of downtime here this morning trying to figure all this out and get the API turned back on again for now.
But we will have to watch close and see what Oracle does to support JAVA in Chrome over the next few months…or I guess we will need to switch browsers…
I am in the same boat as You. I am an ebay seller and use the Java applet to print my shipping labels. I am worried about what I will do.
I love the fact that google syncs with my phones and my PC and all my devices. I am Sad :(
Wake up google you have business Owners you are pushing to other Browsers.
I manually used Windows Update 2015-04-14 on Win7 x64 Home. 17 updates were successfully installed. After Restart I successfully installed latest Flash on IE11, Fx 37.0.1, and Chrome 18.104.22.168 m. After Restart I installed latest Java 8 Update 45 which appeared to be successful, but testing after restart of any web based Java application fails because the Flash plug-in is not supported. Examples include:
http://www.wordle.net/create – enter text and click “Go”.
https://www.java.com/en/download/installed.jsp and click “I agree”.
http://javatester.org/version.html all show “This Plug-in is not supported.”
Your circumvention (until September) worked for me in latest Chrome stable, but latest IE11 and Firefox still fail. Is there a fix or circumvention for these browsers?
Is Java showing up in Firefox when you enter about:plugins?
Yes, Java shows enabled:
Java(TM) Platform SE 8 U45
Path: C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll
Next Generation Java Plug-in 11.45.2 for Mozilla browsers
Check about:addons and there plugins. Is Java enabled there or set to click to play? It may be that an extension or program interferes with that, have you checked that?
Latest Firefox works for latest Java if I try in a “Private Browsing Window” so the problem does appear to be an extension – well done! I’ll have to half-split disabling them to find the culprit. BTW, incognito in Chrome did not help at all yesterday, so I incorrectly did not try it in Fx. Thanks!
Updating NoScript to 22.214.171.124 fixes the Firefox problem for me. Now to figure out why IE11 on Windows 7 x64 Home doesn’t work….
http://www.wordle.net/create now works in IE11 using win7 x64 Home because I deleted the AdBlock Plus extension. This is the only site I care about; the other two might be made to work using Java Console, but I haven’t explored that.
I was inspired to change EMET 5.2 from “Stop on exploit” to “Audit only”. Now http://www.javatester.org/version.html and http://javatester.org/version.html work in IE11.
It still doesn’t block Windows OS… such a shame.. xD
(Just could not resist)
But seriously it’s about time to seriously block all by default then choose what you want like a firewall, unless I’ve got the source code in my hands and I’ve compiled it there is no way I’m trusting any company theses days.
There is nothing like a free meal anymore.
> We don’t have ‘click-to-play’ anymore though.
The plugins you mention are NPAPI
Chrome 42 no longer admits NPAPI plugins by default
except with about:flags : activate NPAPI
This is seriously gonna impact app developers! ohhh well.. its gonna be better in the long run.
My work use an app that is reliant on using silverlight – as we use the chrome browser, (which ties in the IE settings with it) – I get the same ‘silverlight’ error using IE as I do chrome.
Way I got round it.. downloaded a ‘portable firefox’ browser, that has java & silverlight installed – and doesn’t automatically update. They will just have to get use to using that for the APP for now on.
Everyone seems to be making a big stink about Google dropping NPAPI plug-ins.
Microsoft dropped NPAPI plug-ins after IE 5.5 SP2 and certainly by IE6.
And google are the bad guys for keeping NPAPI alive so much longer than M$?
That’s fine if they drop support as MS did, but Silverlight and Java work in IE11, but now not in Chrome. Why stop support now? Why not wait until there is a fully functioning version of each, and then stop support? Why not have a fix other than chrome://plugins which the standard user can mess things up there? Plus it won’t work forever. You can’t just stop support for something that people rely on without a replacement.
Perhaps many people have stopped using IE many moons ago but FWIW I have IE7.. I use it now when I must print something because Chrome doesn’t support Java even with the work-a-round… amen
I’m using Chrome version 42.0.2311.90 m. I tried these instructions and it still doesn’t work, some images are not showing. I’ve also tried all the other suggestions I’ve found online, such as clearing cache (doesn’t resolve the problem) disabling Adblock (same result), and other bogus solutions and guesses from “tech” people. I don’t want to dump Chrome, but will if I have to.
I’m not sure if this is due to the changes that were done with Chrome and Silverlight now hating each other but it has rendered an application I use to create our schools yearbook useless. The strange thing is that it works fine on my home desktop win 7 64 bit with the Chrome workaround on this site, but it refuses to cooperate on my work laptop/desktops using win 7 64 bit as well.
Does anyone know if there could be any type of Windows policies/windows update omitted/whatever the admin at my work could have installed on all the computers to prevent it from functioning properly. The app loads fine in Chrome/FF/IE but when I enter into a function of the app to edit a yearbook page, the page is so small I can barely see it. Even when I zoom in it barely gets bigger than my thumb nail, where as normally it would take up my screen like when in a Google Doc.
For reference I am using FotoFusion online editor.
Any insight is appreciated.
This worked for me on Chrome (Version 42.0.2311.90 m (64-bit))! I have silverlight plugin working now.
> There is no button or menu item that you can click on Chrome’s interface to display the list of plugins.
It’s ridiculously hidden, but you -can- get to the plugins page via a menu. settings -> show advanced -> Content Settings -> Mange individual plug-ins. The URL is way faster but I wanted to point this out.
Thank you!! (although it took me 2 weeks to stumble across this article). At least now I can go back to using 1 browser (for now), instead of continuously switching between IE, firefox and chrome…
This is called: “how to hold the people that make money for you hostage by shutting off their ability to work with your product”… The finger pointing game Google points to Oracle until they surrender; just like 2 y/o’s playing in a sandbox.. I did the temp work-a-round to get Java installed but still doesn’t work in Chrome have to use it in IE many websites appear unstable now using Chrome.. Good luck after September I don’t like it when any company makes changes *without* giving their customers a choice to use something else..
Google announced 2 YEARS AGO that they were going to be doing this, I had forgotten like most people. Everyone, including all the dev’s of the plugins were aware and just refused to believe or didn’t care that this was going to happen. It’s their own fault for either A. not moving forward and finding a way to stay functional with Chrome or B. not physically being able to update their plugins to conform. I congratulate Google for rocking the internet and trying to move it forward and leaving these old plugins behind because if they don’t then who will? Microsoft?? Yea right, they are too busy playing catch up and making Windows 10 the opposit of what everyone wants. Mozilla?? They are just happy in being the 2nd choice right behind Chrome for those who “hate” Google. Lesser known browsers?? No one would even notice.
We could be doing so many cool things with the Internet if only people wouldn’t be stuck in the past and afraid to let it evolve. Wake up people it’s no longer the 90’s. The internet is broken in 2 with the new being held back by the old. It’s either it evolves, or it stays where it is and the security flaws get worse. Java, Flash, Silverlight are constantly being attacked by malicious people trying to find ways through it. Java was once one of the worst unsecure plugins and I refuse to install it unless I really have to.
Also those plugins are not making Google money but vice versa, Google was doing them a service by letting them be useable with their browser for so long. It will just be a matter of time now until the other browsers will follow suit.
TL:DR The issue I posted about earlier is not even Chromes fault as I was able to reproduce it in FF/IE. I got Silverlight working but it seems it is because my Windows 7 is in French and the applet I am using is confused by that.
Google MUST allow the user to have access to NPAPI after September 2015, or they WILL lose very many users, and consequently very much advertising revenue as well. Opera whilst an alternative is now “owned” by Google so it’s just a matter of time before this crappy policy also migrates to that browser too.
I blame this kind of nonsense on the fact that Google Chrome developers are all working on bleeding edge hardware costing thousands of bucks per workstation, and most users don’t have that. So the user is foisted off with some multithreaded leviathon of crud, which doesn’t really work on the older hardware. Also Google techs are more concerned with the technical performance figures of their browser, rather than making an application which works as the USERS want it to !
Whilst the various Chrome Apps are quite handy, many NPAPI plugins are ESSENTIAL for users. Maybe it is time to look at rival browsers, and not just the mainline variety, of IE & Firefox & etc. Though Windows user MUST use IE as it is part of the SYSTEM, they don’t *need* to use it for web browsing per se.
Check out this list of alternatives, which includes mainstream browsers, but I liked particularly, the Pale Moon which is very fast and especially its 64-bit version is much faster on older upgraded XP Laptops that have now 64-bit Win 8.
Avant Browser though, has a real killer feature that can spell doom for Google’s Chrome, should they continue messing users about. Avant Browser isn’t simply a skinned version of someone elseâ€™s web browser. For a start, it includes the three main rendering engines: Webkit, Gecko and Trident as used by Google Chrome, Mozilla Firefox and Microsoft Internet Explorer. You can set the default rendering engine; the current page can be reloaded in a different engine from the right-click menu and you can view a page in three different engines on three different tabs.
Do try out the Pale Moon, Avant, and whatever takes your fancy. Frankly I have just about had it with “Google” !
This Wikipedia page is very useful too as it gives a summary of all the different capabilities of a large number of different Web Browsers, both legacy and current versions. Avant, does not support NPAPI despite its “Three Rendering Engines”. The good news is that Pale Moon does. PM is like a lightweight version of Older Firefox.
There’s many other choices too, but I must say I wouldn’t even be looking at this, if Google hadn’t decided to be so very authoritarian, and showing arrogant superiority to and disdain for its users ! I just wanted to reliable browse the web and use ALL my websites – MANY of which rely of Plugins of various sorts. Now I have to mess about trying and testing alternative browsers, instead of doing what I wanted today. Google you really are a menace to users !
Google announced two years ago they were going to do this. SO you had plenty of time to adjust, you just probably forgot like 85% of the users. Those plugins are what’s holding back the evolution of the internet. Google is just trying to help move it along which is good for us in the long run. You are just mad because it just all of a sudden affected your daily routine and you had to stop and think for yourself for a minute.
Where were your plugins warnings that this was comming??? For some it was in their forums, other’s didn’t even bat an eye. As I see it, it should have been the plugins announcing to the world that they were being dropped by Google, the #1 browser in the world, and not the other way around. Maybe that would have made you question the plugins integrety instead and understood what Google is trying to do.
Why is it Google’s job to be complacent and cater to everyone, when they don’t have to. Trying to appeal to everyone is a waste of ressources and could be used to help make their browser how they see fit.
Besides we can’t rely on Microsoft or Mozilla to lead the charge. Microsoft is too occupied with making Windows 10 the opposite of what everyone wants, and Mozilla is busy competing to stay 2nd choice to Chrome.
I tested in incognito mode (win7x64 SP1) using http://www.wordle.net/create and
Chrome 43 stable still works for me for Java, but will not when Chrome 45 appears per
I only use Chrome 42 or newer. I have uninstalled Silverlight, didn’t install other plugins, and block 3rd party cookies. I only have to run http://www.superantispyware.com/ once a month now. It rarely finds anything. Occasionally a tracking cookie will slip through. Spybot never finds anything worth mentioning on my computer. rotfl
I use Chrome Stable for logging into accounts and general web surfing. I use Chrome Canary with Zenmate VPN to watch blocked content. :)
Here’s the gmail chat people saying that “uh…actually we use NPAPI for the google chat video plugin…” (one suggestion they say is to use a different browser [!])
Well looks like I’m going to have to use Firefox if my Chrome manages to somehow get around the auto block for updates that I have done.
As roger said it may be hilarious But I need to use Google Talk. Hangouts is awful, it doesn’t even differentiate between PC users and Android users, let alone whether people have a webcam or not.
If there’s not a PPAPI version of Talk coming out, and the workaround for stopping updates doesn’t, then I (and anyone else I know that uses Talk) will be using Firefox.
P.S, the work around is to go to MSCONFIG and disable (under startup AND services) anything to do with Google.
VLC plugin uses NPAPI, so it has been disabled too. There is VXG plugin, good for RTSP, here is the demo – http://rtpstream.com/nacl_player/