Potentially vulnerable browser plugins
Updated 4 months ago
by
Yana Shch
Related articles
Plugins should not be confused with browser add-ons. An add-on is a type of browser extension that you normally download from a place like the Chrome store. Add-ons are executed within a browser process. An example of browser add-ons would be AdBlock or Ghostery.
In comparison, plugins typically come pre-installed with the browser or downloaded from a 3rd party website. An example of a plugin is Adobe Flash or Widevine. Plugins typically run on a separate process that inherits all rights from the currently active user, which leads to all kinds of vulnerabilities.
The danger of leaving plugins enabled
Some plugins like Flash or Widevine have a documented API which allows retrieving various uniquely identifiable data points about the parent machine. Other plugins may also have an API, whether public or private, that may present danger to online privacy. Since plugins are essentially closed-source binary files, there is no sure way to evaluate which security holes a certain plugin may have.
Fingerprinting through enumeration
Another danger comes from browser plugin enumeration. Even if a website is not able or unwilling to retrieve uniquely identifiable data through plugins API, it may still collect uniquely identifiable data in the form of a plugin list. A plugin list that contains a version for each plugin may significantly narrow down the segment a user belongs to. Multiple browsing sessions can be linked together based on this data alone or coupled with other data points.
Default plugins in Firefox and Chrome
By default, Firefox has no plugins installed.
Chrome has four plugins bundled in:
- Chrome PDF plugin
- Chrome PDF viewer
- Native client
- Widevine Content Decryption Module
How Multilogin works with plugins
If you open your profile settings and go to "Advanced" → "Browser plugins" you will see two options:
- Enable potentially vulnerable plugins
- Enable Flash plugin
Both options are disabled by default. That means:
- In Stealthfox no plugins are enabled
- In Mimic websites won't be able to actually access the plugins even though they will appear as enabled
There are separate tumblers to enable Flash plugin and all other default plugins. This is done for two reasons. Firstly, Flash plugin is arguably more dangerous than the rest, since it was the first to be exploited by websites for user fingerprinting. Secondly, Flash is also the most needed plugin from the four in certain cases.
We recommend leaving both options disabled at all times. Should you decide to enable either of the two for a good reason, keep in mind that you are exposing yourself to a potential risk of revealing uniquely identifiable data to websites.
Can we alter the data that Flash plugin reveals?
While this is theoretically possible, it makes no sense in real life. In theory, this would require disassembling every version of Flash plugin and injecting its own binary code in them, which is a Sisyphean task. Furthermore, bundling Flash plugins modified this way would be illegal.
This is also unnecessary since developers of all modern browsers already realized the threat coming from Flash plugin. It is now disabled by default in all popular browsers. By having it disabled, you blend into the crowd, while enabling it proactively makes you stand out instead.
