Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Microsoft Edge to Block Flash by Default

Microsoft Edge is the latest Web browser to switch to HTML5 and keep Flash blocked by default unless users enable it to run on sites that require it.

Microsoft Edge is the latest Web browser to switch to HTML5 and keep Flash blocked by default unless users enable it to run on sites that require it.

Both Google and Mozilla announced similar moves for the Chrome and Firefox browsers, and Microsoft appears determined to join the pack. While Chrome 55 started blocking Flash by default earlier this month, Mozilla announced in July that Firefox would make a similar move next year. For now, only some Flash content on web pages is being blocked.

Adobe’s Flash Player has been a key driver for rich online content for a very long time, but the large number of vulnerabilities constantly discovered in it, coupled with performance issues, encouraged large Internet players to move away from it. In fact, even Adobe is currently encouraging the deprecation of Flash, and it doesn’t come as a surprise that major browsers are already taking big steps in this direction.

Microsoft Edge is already providing users with some control over Flash through selectively pausing certain Flash content that is not central to the page, such as ads. All users of the Windows 10 Anniversary Update benefit from this increased control over Flash content, which is set to become even more aggressive next year, when Windows 10 Creator’s Update arrives.

“In our next release, we will extend this functionality and encourage the transition to HTML5 alternatives by providing additional user control over when Flash content loads. Windows Insiders will be able to try an early implementation of this feature soon in upcoming preview builds,” Crispin Cowan, Senior Program Manager, and John Hazen, PM Manager, Microsoft Edge, explained.

Starting next year, Microsoft Edge will deliver a clean HTML5 experience when encountering sites that support the standard, and will block Flash altogether in such cases, which should result in improved performance, battery life, and security. When encountering sites that still depend on Flash, the browser will request users to allow it to load and run, and the option will be saved for subsequent visits.

Advertisement. Scroll to continue reading.

To ensure that the transition to HTML5 is smooth, however, the change will not be applied to the most popular sites in the beginning, Microsoft says. Following several months of evaluation and monitoring of Flash consumption in Microsoft Edge, the company will shorten the list of automatic exceptions.

“We advise web developers to migrate to standardized content delivery mechanisms like JavaScript and HTML5 Encrypted Media Extensions, Media Source Extensions, Canvas, Web Audio, and RTC in the coming months,” Cowan notes.

Related: Adobe Patches Flash Zero-Day Exploited in Targeted Attacks

Related: Flash Player Remains Main Target of Exploit Kits: Report

Related: HTML5 Won’t Stop Malvertising, Brings New Threats

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Organizations are investing heavily in third-party risk management, but breaches, delays, and blind spots continue to persist. Join this live webinar as we examine the gap between how organizations think their third-party risk programs are performing and what’s actually happening in practice.

Register

Explore how attackers are using AI to scale threats and how security teams can respond with AI-driven defenses. Protecting against unmonitored use of generative AI (Shadow AI) in business units and building and enforcing AI governance frameworks.

Register

People on the Move

Rapid7 announced that Wael Mohamed will assume the role of Chief Executive Officer, replacing current Chief Executive Officer Corey Thomas, who will become Executive Chairman of the Board.

Anurag Jain has been appointed Senior Vice President of Engineering at CodeHunter.

CTERA has appointed Tal Sarfaty as Senior Vice President of Cybersecurity.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.