Mozilla today outlined its plans for supporting Flash in Firefox. The company’s browser will block Flash content “that is not essential to the user experience” starting in August 2016 — meaning Firefox 48 and up, as we’re currently on version 47. Starting sometime in 2017 (so not before Firefox 51), Mozilla’s browser will require click-to-activate approval from users before a website activates the Flash plugin for any content.
This is similar to how Google and Microsoft are handling Flash. Last year, Chrome started automatically pausing less important Flash content (like ads), meaning less Flash content has been enabled on pages for all users as of September 2015. Microsoft plans to follow suit with Edge this summer, presumably after the Windows 10 Anniversary Update rolls out.
Mozilla also plans to block Flash content invisible to users. Though it didn’t give a timeframe for when this will occur, the company estimated the change will “reduce Flash crashes and hangs by up to 10 percent.” The changes will be implemented based on a curated list of Flash content that can be replaced with HTML, and this list will expand to include the use of Flash to check content viewability, further improving performance and device battery life.
The end goal for all these browser makers is to push as many sites as possible to HTML5, which is better for both performance (lowering memory and CPU usage while boosting battery life) and in terms of web standards (which makes life easier for developers). Given Flash’s various vulnerabilities, there are obvious security gains as well.
Indeed, Mozilla is echoing both Google and Microsoft in its reasoning for limiting Flash: “enhanced security, improved battery life, faster page load, and better browser responsiveness.” The company recommends web developers start thinking about making the switch as soon as possible:
Websites that currently use Flash or Silverlight for video or games should plan on adopting HTML technologies as soon as possible. Firefox currently supports encrypted video playback using Adobe Primetime and Google Widevine as alternatives to plugin video.
Mozilla today also shared an interesting anecdote regarding Firefox stability. The plugin crash rate in Firefox has dropped significantly over the past year and a half, which the company attributes to websites switching from Flash to other web technologies:
Flash isn’t the only plugin that Firefox is kicking to the curb. Back in October 2015, Mozilla announced plans to drop support for all NPAPI plugins in Firefox, except Flash. This move was originally scheduled for the end of 2016, but has since been pushed back to March 2017. Now we know Flash will follow soon after, though we can expect the change will be made gradually, in line with how we’ve seen the death of Flash so far.
Mozilla offers a Firefox version called Extended Support Release (ESR) for schools, universities, businesses, and others who need help with mass deployments. The next major ESR release, which is also scheduled for March, will continue to support plugins until early 2018.
You can't solo security COVID-19 game security report: Learn the latest attack trends in gaming. Access here