A new method for blocking approved plug-ins from third-party sources appeared in the developer's version of Google's Chrome browser. Available on Friday for Windows, Mac, and Linux, Google Chrome dev 6.0.490.1 includes numerous bug fixes and introduces the Click-to-Play feature for more finely tuned plug-in control.
Click-to-Play adds a small but useful level of functionality to Chrome's native plug-in blocking. It allows Chrome users to activate a plug-in on a per-page basis. Without it, users can only toggle plug-in activation on a per-site basis.
To see how it works, first, you're required to activate it using the "enable-click-to-play" command line switch. Then go to Options, Under the Hood, Content Settings, and choose "Plug-ins" and "Do not allow any site to use plug-ins" to disable all plug-ins. Load a site that uses Flash, such as CNET TV, and you should see the puzzle piece icon shown in the screen capture above. Disabling plug-ins without Click-to-Play will make Chrome think that the plug-in isn't installed. With both, users will see the location bar plug-in icon in the top right of the above screenshot.
The security implications of the switch would be minor, except that slow-to-update third-party plug-ins represent a major risk vector for browsers. Click-to-Play represents a reasonable attempt to place more control in the hands of users, and it could have major implications for user-determined ad blocking that still enables the user to see his or her desired plug-in based content.
This version of Chrome dev also includes fixes that repair how autofill adds addresses and how extension syncing behaves. It also includes Options menu fixes on Macs. The Chrome dev 6.0.490.1 changelog is available at the Chrome release blog.