Home / ubuntu / Questions / 777964
Accepted
Socrates
Asked: 2016-05-27 13:37:28 +0800 CST

Is the Flash plugin on Chrome safer than Firefox?

  • 772

I was always very happy with Firefox and never felt the need to change to Chrome. But Adobe has stopped supporting Flash on Linux and Google has taken over this task. Though Google only supports its Flash for Chrome and not for Firefox.

Is it now necessary to change from Firefox to Chrome to enjoy safety and functionality regarding Flash?

firefox

4 Answers

  1. Best Answer

    Indeed for the latest flash you will need chrome or chromium with pepperflashplugin-nonfree package (chrome and pepper flash are available for 64bit only).
    However firefox uses flash player which is old and it may have bad performance but it still gets some security updates so it can be considered secure enough.

    I always prefer chromium because I believe it's faster (however with greater ram usage) but both browsers have excellent security.

    Just keep in mind that flash is going to die sooner or later so don't care about it. Most sites use html player instead of flash nowadays (remember that android doesn't support flash at all) and I read somewhere that google plans on blocking flash player on every site by default in a few months (user will have to explicit enable flash in a specific site).

    So I believe you can still use firefox with no problems at all if you like it.

    • 6

  2. To be clear, Adobe absolutely patches security vulnerabilities in the Firefox Linux 11.2.202.x Flash releases. They just stopped releasing new features. Google's Linux version does both.

    That said, here's an excerpt from APSA16-01, the emergency Flash security advisory from April:

    A critical vulnerability (CVE-2016-1019) exists in Adobe Flash Player 21.0.0.197 and earlier versions for Windows, Macintosh, Linux, and Chrome OS. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system.

    Adobe is aware of reports that CVE-2016-1019 is being actively exploited on systems running Windows 10 and earlier with Flash Player version 20.0.0.306 and earlier. A mitigation introduced in Flash Player 21.0.0.182 currently prevents exploitation of this vulnerability, protecting users running Flash Player 21.0.0.182 and later.

    I don't know for sure, but it implies that the heap mitigation introduced in 21.0.0.182 was not backported to the Firefox Linux 11.2.202.577 version at the time. Now, it's possible that the exploit could be improved to attack 21.0.0.182 despite the mitigation, and it's likely no one bothered to exploit Linux at all, but it sounds like the Chrome 21.0.0.x series is a harder target.

    Personally, Firefox is my normal "daily driver", but i fire up Chrome when i need to run Flash.

    • 4

  3. I think Firefox is more better then Chrome.

    So if you needed Flash you can try Chrome, but both for ethical and for features, primarily the security, Firefox has the first position for me!

    Which site require Flash? If you are talking about YouTube, you can watch it also without it!

    • 1

  4. If you prioritize security, use Firefox. If you're looking for more plugin support, use Google Chrome or Chromium.

    In my experience, I've found that Firefox errs more on the side of security than does Google Chrome. For example, in the case of early-stage implementations for Cross-Origin Resource Sharing, Firefox operated more strictly than the standard and Chrome operated more loosely than the standard. They are just examples though, these particular issues have already been fixed.

    • 0