Adobe Releases Sandboxed Flash Player For Firefox

Trailrunner7 writes "Adobe has released a new version of their Flash player that now gives Firefox users the additional security of a sandbox and also includes a background update mechanism for Mac users. Flash has run in a sandbox on Google Chrome and Internet Explorer for some time already. The big security news in Flash player 11.3 is the addition of the protected mode sandbox for Firefox on Windows. That's a major change for Adobe, which has been adding sandbox to its main product lines for a couple of years now. Adobe Reader X has run in protected mode — which is what Adobe calls its sandbox — since its release, and the company also added a sandbox to Flash on Google Chrome. The sandbox is designed to prevent attackers from using vulnerabilities in Flash to break out of the application and move to other apps or the OS itself."

Re:How about they release a new 64bit version for

[TheCycoONE]

I'm not sure if you recall, but Flash for linux is discontinued unless you're using the bundled Chrome version (http://www.osnews.com/story/25639). In light of that I've given up on the idea of them fixing any major bugs for that platform.

Re:How about they release a new 64bit version for

[cheesybagel]

I guess someone will have to get Gnash to work. Or something.

Re:Best sandbox ever ...

[h4rr4r]

They have an HTML5 version for many things.

Re:Best sandbox ever ...

[Anonymous Coward]

YouTube? I know a few people visit that site.

YouTube [github.com] can be watched with a Python script.

Re:Would be nice if it wasn't a memory hog

[terbeaux]

Aside from getting more memory I would recommend that you update one of "the most targeted pieces of software" more often then just when YT stops working. There have been so many exploits released for Flash and Adobe released a lot of security updates to address them. http://www.gfi.com/blog/the-most-vulnerable-operating-systems-and-applications-in-2011/ [gfi.com]

Re:Best sandbox ever ...

[Shikaku]

http://userscripts.org/scripts/show/94609 [userscripts.org]

This forces HTML5 forever, and it seems to work with just about any video.

Greasemonkey required though.

Only Chrome, not even other Pepper implementations

[tepples]

I was under the impression that it wouldn't even be available for Chromium Browser, which implements the same Pepper API as Google Chrome. According to Adobe's blog [adobe.com], not only will Flash Player "only be available via the 'Pepper' API", but the Pepper version will be distributed "as part of the Google Chrome browser distribution and will no longer be available as a direct download from Adobe". So even if you have another browser that implements Pepper, it still won't be able to run Flash Player for Pepper because Flash Player for Pepper is exclusive to Google Chrome.

Note: not for XP

[PatPending]

From Adobe's news release: [adobe.com]

[Emphasis added]

The restrictions we apply to this sandboxed process come from the Windows OS. Windows Vista and Windows 7 provide the tools necessary to properly sandbox a process. For the Adobe Reader and Acrobat sandbox implementation introduced in 2010, Adobe spent significant engineering effort trying to approximate those same controls on Windows XP. Today, with Windows 8 just around the corner and Windows XP usage rapidly decreasing, it did not make sense for the Flash Player team to make that same engineering investment for Windows XP. Therefore, we've focused on making Protected Mode for Firefox available on Windows Vista and later.