Help Keep Threats at Bay With ‘Click-to-Play’
Summary: Krebs on Security describes Click-to-Play, a feature in Chrome, Firefox and Opera that blocks browser plugin content by default and replaces it with a blank box until the user clicks to enable Flash or Java. The post gives step-by-step settings for each browser, notes that Safari relies on the ClickToFlash or ClickToPlugin extensions and that Internet Explorer 10 uses a Microsoft whitelist of sites allowed to play Flash by default, and recommends unplugging Java from the browser entirely.
What you should know: A commenter reports that Chrome engineers stated plainly that "click to play is not actually a security boundary," because its interface sits in the frame and is open to clickjacking, while blocking plugins through the context menu is not. That leaves security leaders relying on a convenience setting that was never intended to stop an attack.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026