August 11, 2016 By Douglas Bonderud 2 min read

Adobe’s Flash player continues to struggle with security. As noted by ZDNet, the company recently disclosed 52 new vulnerabilities that could lead to remote code execution and includes memory corruption, heap buffer overflows and use-after-free issues.

While a security update was quickly issued to resolve these concerns, the constant break-fix cycle has led some companies — Google and Twitch, for example — to speed their HTML5 update timelines and phase out Adobe’s offering. What does a web experience low on Flash really mean for the future of online security?

Flash in the Pan

According to Google’s official Chrome blog, the time has come to “de-emphasize Flash in favor of HTML5.” While the company acknowledges the “pivotal role” of Adobe’s offering in the evolution of web-based video, gaming and animation, there’s a problem: More than 90 percent of this Flash-based content now loads behind the scenes, not only slowing down the end-user browsing experience, but also increasing the risk of security breaches.

With the release of Chrome 53 this September, the search giant won’t simply ask users if they prefer Flash or HTML5, but will actively block Flash from running unless sites only support the Adobe player. As noted by Ars Technica, the new Firefox 48 release “almost exactly mirrors” the Chrome update. According to TechCrunch, video-streaming site Twitch is also rolling out a beta HTML5 update to replace Flash for its subscribers.

HTML5 Update Improves Speed and Security

So what’s the big benefit for users as companies make the switch from Flash to HTML5? Google said the new technology means reduced power consumption and faster load times, while Twitch users should see fewer frame drops and less CPU load.

Of course, HTML isn’t without its own issues. As noted by Softpedia, HTML5 ads aren’t always safer than their Flash counterparts. This begs the question: Will the move to HTML5 really mean better security for end users or just another set of personal browser problems?

According to ComputerWeekly, there are distinct advantages to choosing the new HTML standard over Flash. First is the rapid uptake of Flash, especially for video players, which led to a massive uptick in vulnerabilities. Coupled with the proprietary nature of Adobe’s code, it became difficult for companies, most famously Apple, to justify the use of this program in their operating systems.

HTML5, by contrast, is an open-source development that leverages JavaScript to perform almost all of its most complex web tasks. The result: Behind-the-scenes loading — where many vulnerabilities flourish — virtually disappears, while developers get more control over how HTML5 deploys in web browsers, displays content and defends against attacks.

HTML5 isn’t perfect, but Flash simply can’t complete. Google’s new stance shouldn’t come as a surprise. It is a significant step toward a less Flashy, more secure web browsing experience.

More from

NIST’s role in the global tech race against AI

4 min read - Last year, the United States Secretary of Commerce announced that the National Institute of Standards and Technology (NIST) has been put in charge of launching a new public working group on artificial intelligence (AI) that will build on the success of the NIST AI Risk Management Framework to address this rapidly advancing technology.However, recent budget cuts at NIST, along with a lack of strategy implementation, have called into question the agency’s ability to lead this critical effort. Ultimately, the success…

Researchers develop malicious AI ‘worm’ targeting generative AI systems

2 min read - Researchers have created a new, never-seen-before kind of malware they call the "Morris II" worm, which uses popular AI services to spread itself, infect new systems and steal data. The name references the original Morris computer worm that wreaked havoc on the internet in 1988.The worm demonstrates the potential dangers of AI security threats and creates a new urgency around securing AI models.New worm utilizes adversarial self-replicating promptThe researchers from Cornell Tech, the Israel Institute of Technology and Intuit, used what’s…

Passwords, passkeys and familiarity bias

5 min read - As passkey (passwordless authentication) adoption proceeds, misconceptions abound. There appears to be a widespread impression that passkeys may be more convenient and less secure than passwords. The reality is that they are both more secure and more convenient — possibly a first in cybersecurity.Most of us could be forgiven for not realizing passwordless authentication is more secure than passwords. Thinking back to the first couple of use cases I was exposed to — a phone operating system (OS) and a…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today