The attack surface with classic NPAPI plugins (Flash, Java, etc) is practically unlimited. It was up to the likes of Flash and Java to secure themselves, not th

The attack surface with classic NPAPI plugins (Flash, Java, etc) is practically unlimited. It was up to the likes of Flash and Java to secure themselves, not the browser. Various random plugins from other sources (eg, the QuakeLive and Unity plugins) may as well have cared about security _even less_ than the already abysmal track record of Flash and Java.