Chrome has a setting to only run plugins with the user's permission. I'd advise it for anyone even remotely skilled enough to use it. I work for with quite a few java applets. Everything I need still works and the bullshit walks.
So does FireFox, if anyone's wondering. about:config -> plugins.click_to_play
I'm wondering, why hasn't Firefox put the setting on as default. Of course it would be quite annoying with the Flash-plugin but I think it's worth the trouble.