Adobe announced on Wednesday that its popular Flash Player is now protected by an OS X App Sandbox as part of this week’s release of Safari in OS X Mavericks, giving Safari users on Apple’s latest OS the ability to view Flash Player content while benefiting from added security protections.
Enforced at the kernel level, an App Sandbox is an access control technology provided in OS X that lets developers describe how an app interacts with the system, and allows users to transparently grant apps additional access by way of Open and Save dialogs, drag and drop, and other familiar user interactions.
As Apple explains in its developer documentation, “by limiting access to resources on a per-app basis, App Sandbox provides a last line of defense against the theft, corruption, or deletion of user data if an attacker successfully exploits security holes in your app or the frameworks it is linked against.”
Adobe has previously worked with Google, Microsoft and Mozilla on deploying sandboxes for their respective browsers, and has now worked with Apple to protect Safari users on OS X.
Peleus Uhley, Platform Security Strategist at Adobe explained a bit on how the sandboxing technology works at a high level.
“This means that there is a specific com.macromedia.Flash Player.plugin.sb file defining the security permissions for Flash Player when it runs within the sandboxed plugin process,” Uhley noted in blog post. “As you might expect, Flash Player’s capabilities to read and write files will be limited to only those locations it needs to function properly.”
In addition to the above security features, the sandbox for Safari also limits Flash Player’s local connections to device resources and inter-process communication (IPC) channels. The sandbox also limits Flash Player’s networking privileges to prevent unnecessary connection capabilities, Uhley said.

For more than 15 years, Mike Lennon has been closely monitoring the threat landscape and analyzing trends in the National Security and enterprise cybersecurity space. In his role at SecurityWeek, he oversees the editorial direction of the publication and is the Director of several leading security industry conferences around the world.
More from Mike Lennon
- Check Point to Acquire SASE Security Firm Perimeter 81 for $490 Million
- Rapid7 Announces Layoffs, Office Closings Under Restructuring Plan
- Horizon3 AI Raises $40 Million to Expand Automated Pentesting Platform
- Watch Now: Cloud & Data Security Summit Sessions
- Watch on Demand: 2023 CISO Forum Sessions
- Virtual Event Today: CISO Forum 2023 – Register to Join
- Watch Now: Threat Detection and Incident Response Virtual Summit
- Registration Now Open: 2023 ICS Cybersecurity Conference | Atlanta
Latest News
- New Supermicro BMC Vulnerabilities Could Expose Many Servers to Remote Attacks
- Lyca Mobile Services Significantly Disrupted by Cyberattack
- Severe Glibc Privilege Escalation Vulnerability Impacts Major Linux Distributions
- Google, Yahoo Boosting Email Spam Protections
- Mozilla Warns of Fake Thunderbird Downloads Delivering Ransomware
- Qualcomm Patches 3 Zero-Days Reported by Google
- Synqly Joins Race to Fix Security, Infrastructure Product Integrations
- ZDI Discusses First Automotive Pwn2Own
