Chrome to Gradually Drop Support for NPAPI Plug-ins

10 years ago, browsers were a lot less powerful and you had to install plug-ins to watch videos, play games, open PDF files. Applications like QuickTime, RealPlayer, Windows Media Player, Adobe Reader, Java installed plug-ins that added missing features. Now browsers can play audio files and video files without plug-ins, some of them include PDF viewers, many of them render interactive 3D graphics natively. NPAPI plug-ins are no longer that necessary, they have plenty of security issues and the NPAPI plug-in architecture from the Netscape era is now outdated.

Google addressed some of the NPAPI issues in Pepper and bundled a Pepper version of the Flash plug-in with Chrome. Pepper is also used by Native Client and the PDF viewer.

The next step: Chromium's blog announced that the NPAPI support will be gradually dropped next year. "NPAPI isn't supported on mobile devices, and Mozilla plans to block NPAPI plug-ins in December 2013. Based on anonymous Chrome usage data, we estimate that only six NPAPI plug-ins were used by more than 5% of users in the last month. (...) Starting in January 2014, Chrome will block webpage-instantiated NPAPI plug-ins by default on the Stable channel. To avoid disruption to users, we will temporarily whitelist the most popular NPAPI plug-ins that are not already blocked for security reasons:" Silverlight, Unity, Google Earth, Google Talk and Facebook Video. Java is already blocked by default for security reasons. "In the short term, end users and enterprise administrators will be able to whitelist specific plug-ins. Eventually, however, NPAPI support will be completely removed from Chrome. We expect this to happen before the end of 2014, but the exact timing will depend on usage and user feedback."

A simplified version of Google Earth is now available in the new Google Maps, while the Google Talk plug-in will no longer be necessary in Chrome when Google Hangouts switches to WebRTC. Silverlight is mainly used for streaming premium video by sites like Netflix, but the DRM support for HTML5 video will change this.

Some Chrome extensions include NPAPI plug-ins. Google will no longer accept new Chrome extensions with NPAPI plug-ins starting today and will unpublish these extensions from the Chrome Web Store in September 2014 if developers don't remove the NPAPI plug-ins.

"There are several alternatives to NPAPI. In cases where standard web technologies are not yet sufficient, developers and administrators can use NaCl, Apps, Native Messaging API, and Legacy Browser Support to transition from NPAPI. Moving forward, our goal is to evolve the standards-based web platform to cover the use cases once served by NPAPI," informs Google.

It will be interesting to see if Google will actually drop NPAPI support next year. There are still many sites that rely on plug-ins and some of them are no longer updated.

To see a list of the plug-ins you use in Chrome, open a new tab and paste chrome://plugins/ in the address bar. Click "Details" to see more information about them (including their type: NPAPI or PPAPI - Pepper). You can also disable plug-ins or check "always allowed".

You'll see at least 4 PPAPI (Pepper) plug-ins that are bundled with Chrome: Flash, PDF Viewer, Native Client and Chrome Remote Desktop Viewer. The list also includes a separate NPAPI version of the Flash plugin that's used by Firefox, Opera, Safari, a Google Update NPAPI plug-in and some other NPAPI plug-ins for software you've installed (Google Talk, Java, iTunes Application Detector, Picasa, Google Earth Plugin).