Ouch. I was under the impression that click-to-play was in fact treated as a security boundary, and finding out that it isn't severely downgrades my estimation of how secure Chrome is.

I do see how preventing clickjacking is hard, and you wouldn't want click-to-play as the only line of defense, but I think Chrome should at least make the effort to do so. A working click-to-play security boundary would reduce the number of sites that get to attempt to exploit me with Flash by more than an order of magnitude.

Click-to-play can never be a security boundary, and you don't need to know anything about the inner workings of Chrome to know that it isn't a security boundary.

Any website can induce you to click somewhere using a psychological trick (for example, a "Next Page" link in an article). There would be no reason to be concerned--after all, merely following a link on a webpage can't be unsafe, right? (After all, you know better than to download software from untrusted sources, so you won't do that. You're just browsing pages.) Then it could use script to replace that link with a malicious plugin in the instant just before you are most likely to click. There--bypassed security boundary.

I find this "you don't need to know the inner workings" lesson analogous to a thought experiment I sometimes ask tech people. I quiz them: Can a USB storage drive harm your computer (install malware, etc.) merely by plugging it in, even if you know better than to run any executable files on it? The answer is (1) Yes, and (2) You don't need any specialized knowledge of how USB works to know this--you just need to know about the existence of USB keyboards. The USB device, despite appearing to be a thumb drive storage device, need merely identify itself as a keyboard, and it can start typing malicious commands after being plugged in.

Ahh crap. Thanks for this. I did not realize click-to-play was so pointless.

Me too. I am every day more appalled by the lack of security of browsers. That being said, logically, if you also have javascript disabled, I presume click-to-play should be secure.

It's not pointless from a usability perspective, just pointless from a security perspective.

chrome://plugins

Disable all of them

Edit: if you have a site that requires a plugin, create a separate chrome user with that plugin enabled and run that site in it

Apparently Chrome isn't affected: http://malware.dontneedcoffee.com/2015/01/unpatched-vulnerab...

That malware is apparently not trying to infect Chrome, but Chrome still carries the vulnerable Flash and runs it by default. Maybe the author of that malware doesn't have or doesn't want to spend a Chrome sandbox escape to attack it, but such escapes have been found in the past, and others are likely lurking.

Thus the advice to disable or block Flash within Chrome, especially since Chrome's Flash hasn't yet been updated for this vulnerability.

> If you can't disable Flash entirely...

I can but there are websites that still rely on Flash for video playback :/

One thing I've noticed is that FAR more sites do video backwards – using Flash if present, falling back to HTML5 if not – than actually do not support it. Spoofing the iPad user-agent gets most all of the remaining sites.

If people keep using Flash, these websites will not adopt another options.

Disabling unsecured plugins will be a long term benefit for us.