Most NPAPI plugins are not sandboxed or auto-updated to track the plugin&#x27;s latest security fixes. Adobe does have an auto-updater and sandbox for Flash. The sandbox (called Protected Mode) is only available for 32-bit Windows, so Mozilla has developed its own Flash sandbox for Win64 Firefox: <a href="https:&#x2F;&#x2F;bugzilla.mozilla.org&#x2F;show_bug.cgi?id=1185532" rel="nofollow">https:&#x2F;&#x2F;bugzilla.mozilla.org&#x2F;show_bug.cgi?id=1185532</a><p>Firefox sandboxes EME &quot;plugins&quot;, called Content Decryption Modules (CDMs), and hard codes a list of trusted and signed CDM DLLs. (Currently, this list is just Adobe&#x27;s Primetime CDM.)<p>Also, because plugins are system libraries, other applications can side-load random plugins into your browser. For example, OS X installs a plugin called &quot;Default Browser Helper&quot; that allows Safari to snoop on your default browser choice and know when Firefox is run: <a href="https:&#x2F;&#x2F;twitter.com&#x2F;dougturner&#x2F;status&#x2F;650575548918296580" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;dougturner&#x2F;status&#x2F;650575548918296580</a>