Chrome 21, currently in beta, brings bad news to those who install extensions from third-party sites. Users will no longer be able to install extensions, apps and user scripts by simply downloading them and clicking “install” in a Chrome box.
Chrome 21 shows a message that’s actually inaccurate: “Extensions, apps and user scripts can only be instlled from the Chrome Web Store.” When you click the “learn more” link, you’ll found there’s actually a way to install .crx files: just download them, open their folder and drag them to Chrome’s extensions page (Tools > Extensions).
“Previously, any website could prompt you to add an extension into your browser. In the latest version of Google Chrome, you must explicitly tell Chrome that you want to install these extensions by adding them through the Extensions page,” explains Google. The reason for this change is that Google can only find and remove malicious extensions in the Chrome Web Store. “Online hackers may create websites that automatically trigger the installation of malicious extensions. Their extensions are often designed to secretly track the information you enter on the web, which the hackers can then reuse for other ill-intended purposes.”
Most likely, this change won’t affect too many users and it will encourage developers to submit their extensions to the Chrome Web Store. Power users will complain that it’s more difficult to install user scripts from sites like userscripts.org and extensions from sites like chromeextensions.org. Maybe Google could add an option in the settings page that lets you disable this security feature.
Update: There’s a command-line flag that disables this feature: –enable-easy-off-store-extension-install. Use the instructions from this page to add the flag. Please note that the feature is available starting with Chrome 21 (right now it’s in the beta channel, but it will be in the stable channel next month).
{ Thanks, Sterling and Ruben. }
