I am looking for a way to set up Google Chrome so that it will run a certain plug-in (Java, what else?) only on whitelisted sites, but other plug-ins (like the PDF viewer) everywhere.

From playing with the policies available for Chrome, I think there are basically two levels of plug-in management:

• List of disabled plugins/enabled plugins: Controls whether a plug-in exists for the browser at all

  This pair of policies applies to plug-ins, but not to sites.

• Default plug-in settings/Allow plug-ins on sites: Controls on which sites plug-ins can run

  This set of policies applies to sites, but not to individual plugins, and it cannot override the first pair.

There appears to be no way to configure Chrome so that some plug-ins only run on whitelisted sites, but others run everywhere by default.

I have also looked at filtering content on the firewall/proxy level, but I'm not convinced it can be done securely there. Filtering by URLs (file names) or content types can be circumvented trivially, and identification by content inspection cannot be safe either.