Browser Plugins

What Is a Plugin?

A plugin is a piece of software that adds a particular feature to a program, thus expanding its functions and abilities. If a program supports plugins, it means you can customize it. The term plugin might be sometimes used interchangeably with the words add-on, extension, and the like. The type of the term used depends on context. In this entry, we will shortly cover what plugins are in general, and then we will focus on browser plugins. After that, we will discuss potential security threats that might be associated with them. Due to their prevalence across browsers and platforms, browser plugins are getting exploited increasingly often by cybercriminals to promote and distribute malware.

The Main Plugin Types

Most of the time, plugins are used to support new program features, reduce program sizes and enable third-party software developers to create more additional functions that improve the application performance.

Although here we will mostly deal with browser plugins, there are a lot more programs that support plugins and use them quite often. For example, there are audio editors, email clients, media players, text editors, and other types of applications that use plugins often. For instance, if you have Audacity, you will need a LADSPA plugin to export audio files. Email clients require plugins to encrypt and decrypt email messages. Media players often need additional plugins to read and play different file formats, and so on.

Browser plugins or extensions literally “expand” browser functionality. The most common classic examples of browser plugins are Adobe Flash Player, Java plugin, QuickTime plugin, and others. While most of these plugins are no longer supported due to security concerns, we will cover a few examples in a few paragraphs below to give you a better idea of why a browser plugin could be such a big security issue. Before that, we should point out certain notes about one particular category and the terms.

Mozilla Plugin Category

As mentioned, the term plugin might sometimes be substituted by an add-on or extension. However, according to the Mozilla definitions, plugin and add-on are two different things. Add-on is something that extends the functions of your browser, so it may coincide with the definition of a plugin that we have presented here. Nevertheless, the “plugin” for Mozilla is a web content renderer based on the Netscape Plugin Application Programming Interface (NPAPI). That is why; extensions and plugins are presented in different panes in the Firefox Add-ons menu.

How Do Plugins Work?

A plugin works together with the host application because it needs the services from the host application to function properly. The main app, on the other hand, can operate independently even if they constantly exchange data with plugins.

Browser plugins are supposed to bypass the limitations of the early type of HTML. They process specific content improving your browser’s functionality. What’s more, browser plugins are highly independent because, even though they need browser services to work, once the browser “gives” the plugin a definite space, it can operate within the given boundaries in whichever way it prefers.

Plugin Examples

We have mentioned the most common types of browser plugins in the previous paragraphs. This part of the entry will give you a concise overview of three plugins, namely Adobe Flash plugin, QuickTime plugin, and Java plugin.

Adobe Flash Player plugin is also called Shockwave Flash on certain browsers, and it has been used to display content created on the Adobe Flash platform. For example, it used to be important to view multimedia, stream video and audio material, and run rich Internet applications. According to the Adobe report from 2015, more than 1 billion desktops used the Flash Player plugin, and around 400 million users would update to the new version of the plugin within a few weeks of its release.

However, at the same time, due to its popularity, the Adobe Flash Player plugin has been and still is plagued by controversies and security issues, which is why its developers used to always urge users to have the automatic update settings on. The older the version, the easier it was for cybercriminals to exploit it because they would not have the latest security fixes.

Due to such security issues, Adobe developers decided to stop releasing new versions of the Adobe Flash player and its plugin. Due to the fact that the new HTML5 format is more common across different browsers, it makes web browsing far more advanced and safer, compared to when users would employ Adobe Flash Player. And this feature is common to almost all plugins out there. As it stands, Adobe no longer supports Flash Player after December 31, 2020, and the Flash content is blocked automatically beginning January 12, 2021.

QuickTime is yet another plugin example that is no longer supported. This extensive multimedia plugin developed by Apple Inc, and Apple ceased support for the Windows version in 2016 and for the macOS version in 2018.

Why was it so important, though? Well, QuickTime was supposed to deal with various video, picture, sound, and interactivity formats. Although it came bundled with the OS X, Microsoft Windows users could also download this plugin as a stand-alone program. Having this plugin on your browser would enable you to play movies and other online media. There also used to be specific websites that would require exactly this extension to play the embedded media.

Java Plugin is required to see interactive content on various websites. The technology is usually a part of the Java Runtime Environment, and it connects your browser with the Java platform. Quite a few web pages still use Java applets for online games. This plugin also has over a billion users, and thus it does not come as a surprise that it may be vulnerable to third-party exploitation.

At the beginning of 2013, it was announced that the Java plugin contained critical security vulnerabilities that could be exploited for cyberattacks. Although the vendor has released a security patch ever since, because of these issues, browsers like Firefox have stopped the Java plugin from running automatically. This brings us to the final part of our entry that deals with security threats associated with browser plugins.

Why Can a Browser Plugin be Dangerous?

Due to its mechanics, a browser plugin can function independently from the browser. That is why it becomes a great tool for spying and potentially corrupted content distribution. Although anyone can manage their plugins, users seldom do so because even today, they are not taken as seriously as they should be.

As you can see, some major browser plugins that have far-reaching functions have been discontinued due to various security issues. But there are still tons of browser plugins out there that can be used by unreliable third parties. Hence, users have to be really careful about what they add to their browsers.

The problem is that just like adware, browser hijackers, and potentially unwanted programs, browser plugins can be downloaded bundled with freeware or installed automatically by a fake software update pop-up that users may encounter on an adware-associated website. This means that users must employ safe web browsing habits to avoid potential security issues.

The most common security problem associated with browser plugins is commercial advertisements. Some security experts call it “malvertising” because the ads displayed are supposedly malicious or associated with malevolent third parties. Browser plugins are used as vehicles to distribute and promote those ads on specific pages you visit. At the same time, we can see that a browser plugin could also track your online activity to provide you with custom commercial content. In that sense, it may be similar to a browser hijacker or adware.

This shows that browser plugins, once exploited, could be used for various purposes by cybercriminals. Thus, if users have unfamiliar or outdated plugins installed on their default browser, the possibility that they could be misused for malevolent purposes is relatively high.

To prevent undesirable consequences, users need to keep their plugins in check all the time. If you do not trust your own skills, it is always a good idea to invest in a licensed anti-malware application. The point with plugins is that you simply need to keep them updated and read twice before you install an additional extension. It is better to be safe than sorry.