Adobe Flash Player

This article is about the browser plugin. For an overview of the platform, see Adobe Flash.

Adobe Flash Player

Original author(s)	FutureWave Macromedia
Developer(s)	Adobe Systems
Initial release	January 1, 1996 (24 years ago)
Stable release(s) [±]
Windows, macOS (China-specific variant) 34.0.0.317 / July 9, 2024 (2024-07-09) Windows, macOS, Linux (Harman enterprise variant) 50.x / N/A Linux (China-specific variant) 34.0.0.137 / April 13, 2021 (2021-04-13) Windows, macOS, Linux, ChromeOS (Global variant, excluding China) 32.0.0.465 / December 8, 2020 (2020-12-08) Internet Explorer 11 and Edge Legacy (Embedded - Windows 8 or later) 32.0.0.445 / October 13, 2020 (2020-10-13) Android 4.0.x 11.1.115.81 / September 10, 2013 (2013-09-10) Android 2.x and 3.x 11.1.111.73 / September 10, 2013 (2013-09-10) Solaris 11.2.202.223 / March 28, 2012 (2012-03-28)
Preview release(s) [±]
Windows, macOS, Linux, ChromeOS 32.0.0.380 Beta / May 14, 2020 (2020-05-14)
Written in	C++
Operating system	Windows, macOS, Linux, Chrome OS (current) Solaris, BlackBerry Tablet OS, Android, Pocket PC (discontinued)
Platform	Web browsers and ActiveX-based software
Available in	Chinese Simplified, Chinese Traditional, English, French, German, Italian, Japanese, Polish, Russian, Portuguese, Spanish, Korean, and Turkish
Typ	Runtime system and browser extension
License	Freeware
Website	adobe.com/products/flashplayer.html

Adobe Flash Player (labeled Shockwave Flash in Internet Explorer and Firefox) is computer software for using content created on the Adobe Flash platform, including viewing multimedia contents, executing rich Internet applications, and streaming audio and video. Flash Player can run from a web browser as a browser plug-in or on supported mobile devices. Flash Player was created by Macromedia and has been developed and distributed by Adobe Systems since Adobe acquired Macromedia in 2005. Flash Player is distributed as freeware.

Flash Player runs SWF files that can be created by Adobe Flash Professional, Adobe Flash Builder or by third party tools such as FlashDevelop. Flash Player supports vector graphics, 3D graphics, embedded audio, video and raster graphics, and a scripting language called ActionScript. ActionScript is based on ECMAScript (similar to JavaScript) and supports object-oriented code. Flash Player is distributed free of charge and its plug-in versions are available for every major web browser and operating system. Google Chrome, Internet Explorer 11 in Windows 8 and later, and Microsoft Edge come bundled with a sandboxed Adobe Flash plug-in.

Flash Player once had a large user base, and was a common format for web games, animations, and graphical user interface (GUI) elements embedded in web pages. Adobe stated in 2013 that more than 400 million out of over 1 billion connected desktops update to the new version of Flash Player within six weeks of release. However, Flash Player has become increasingly criticized for its performance, consumption of battery on mobile devices, the number of security vulnerabilities that had been discovered in the software, and its closed platform nature. Apple co-founder Steve Jobs was highly critical of Flash Player, having published an open letter detailing Apple's reasoning for not supporting Flash on its iOS device family. Its usage has also waned because of modern web standards that allow some of Flash's use cases to be fulfilled without third-party plugins.

In July 2017, Adobe announced that it will end support for Flash Player on December 31, 2020, and continued to encourage the use of open HTML5 standards in place of Flash. The announcement was coordinated with Apple, Facebook, Google, Microsoft, and Mozilla. In September 2019, Microsoft announced that on December 31, 2020, Flash will be entirely removed from all browsers via Windows Update.

Eigenschaften

Adobe Flash Player is a runtime that executes and displays content from a provided SWF file, although it has no in-built features to modify the SWF file at runtime. It can execute software written in the ActionScript programming language which enables the runtime manipulation of text, data, vector graphics, raster graphics, sound and video. The player can also access certain connected hardware devices, including the web cameras and microphones, after permission for the same has been granted by the user.

Flash Player is used internally by the Adobe Integrated Runtime (AIR), to provide a cross-platform runtime environment for desktop applications and mobile applications. AIR supports installable applications on Windows, Linux, macOS, and some mobile operating systems such as iOS and Android. Flash applications must specifically be built for the AIR runtime to use additional features provided, such as file system integration, native client extensions, native window/screen integration, taskbar/dock integration, and hardware integration with connected Accelerometer and GPS devices.

Data formats

Flash Player includes native support for many data formats, some of which can only be accessed through the ActionScript scripting interface.

• XML: Flash Player has included native support for XML parsing and generation since version 8. XML data is held in memory as an XML Document Object Model, and can be manipulated using ActionScript. ActionScript 3 also supports ECMAScript for XML (E4X), which allows XML data to be manipulated more easily.
• JSON: Flash Player 11 includes native support for importing and exporting data in the JavaScript Object Notation (JSON) format, which allows interoperability with web services and JavaScript programs.
• AMF: Flash Player allows application data to be stored on users computers, in the form of Local Shared Objects, the Flash equivalent to browser cookies. Flash Player can also natively read and write files in the Action Message Format, the default data format for Local Shared Objects. Since the AMF format specification is published, data can be transferred to and from Flash applications using AMF datasets instead of JSON or XML, reducing the need for parsing and validating such data.
• SWF: The specification for the SWF file format was published by Adobe, enabling the development of the SWX Format project, which used the SWF file format and AMF as a means for Flash applications to exchange data with server side applications. The SWX system stores data as standard SWF bytecode which is automatically interpreted by Flash Player. Another open-source project, SWXml allows Flash applications to load XML files as native ActionScript objects without any client-side XML parsing, by converting XML files to SWF/AMF on the server.

Multimedia formats

Flash Player is primarily a graphics and multimedia platform, and has supported raster graphics and vector graphics since its earliest version. It supports the following different multimedia formats which it can natively decode and play back.

• MP3: Support for decoding and playback of streaming MPEG-2 Audio Layer III (MP3) audio was introduced in Flash Player 4. MP3 files can be accessed and played back from a server via HTTP, or embedded inside an SWF file, which is also a streaming format.
• FLV: Support for decoding and playing back video and audio inside Flash Video (FLV and F4V) files, a format developed by Adobe Systems and Macromedia. Flash Video is only a container format and supports multiple different video codecs, such as Sorenson Spark, VP6 and more recently H.264. Flash Player uses hardware acceleration to display video where present, using technologies such as DirectX Video Acceleration and OpenGL to do so. Flash Video is used by YouTube, Hulu, Yahoo! Video, BBC Online and other news providers. FLV files can be played back from a server using HTTP progressive download, and can also be embedded inside an SWF file. Flash Video can also be streamed via RTMP using the Adobe Flash Media Server or other such server-side software.
• PNG: Support for decoding and rendering Portable Network Graphics (PNG) images, in both its 24-bit (opaque) and 32-bit (semi-transparent) variants. Flash Player 11 can also encode a PNG bitmap via ActionScript.
• JPEG: Support for decoding and rendering compressed JPEG images. Flash Player 10 added support for the JPEG-XR advanced image compression standard developed by Microsoft Corporation, which results in better compression and quality than JPEG. JPEG-XR enables lossy and lossless compression with or without alpha channel transparency. Flash Player 11 can also encode a JPEG or JPEG-XR bitmap via ActionScript.
• GIF: Support for decoding and rendering compressed Graphics Interchange Format (GIF) images, in its single-frame variants only. Loading a multi-frame GIF will display only the first image frame.

Streaming protocols

• HTTP: Support for communicating with web servers using HTTP requests and POST data. However, only websites that explicitly allow Flash to connect to them can be accessed via HTTP or sockets, to prevent Flash being used as a tool for cross-site request forgery, cross-site scripting, DNS rebinding and denial-of-service attacks. Websites must host a certain XML file termed a cross domain policy, allowing or denying Flash content from specific websites to connect to them. Certain websites, such as Digg, Flickr, Photobucket already host a cross domain policy that permits Flash content to access their website via HTTP.
• RTMP: Support for live audio and video streaming using the Real Time Messaging Protocol (RTMP) developed by Macromedia. RTMP supports a non-encrypted version over the Transmission Control Protocol (TCP) or an encrypted version over a secure Transport Layer Security (SSL) connection. RTMPT can also be encapsulated within HTTP requests to traverse firewalls that only allow HTTP traffic.
• TCP: Support for Transmission Control Protocol (TCP) Internet socket communication to communicate with any type of server, using stream sockets. Sockets can be used only via ActionScript, and can transfer plain text, XML or binary data (ActionScript 3.0 and later). To prevent security issues, web servers that permit Flash content to communicate with them using sockets must host an XML-based cross domain policy file, served on Port 843. Sockets enable AS3 programs to interface with any kind of server software, such as MySQL.

Performance

Hardware acceleration

Until version 10 of the Flash player, there was no support for GPU acceleration. Version 10 added a limited form of support for shaders on materials in the form of the Pixel Bender API, but still did not have GPU-accelerated 3D vertex processing. A significant change came in version 11, which added a new low-level API called Stage3D (initially codenamed Molehill), which provides full GPU acceleration, similar to WebGL. (The partial support for GPU acceleration in Pixel Bender was completely removed in Flash 11.8, resulting in the disruption of some projects like MIT's Scratch, which lacked the manpower to recode their applications quickly enough.)

Current versions of Flash Player are optimized to use hardware acceleration for video playback and 3D graphics rendering on many devices, including desktop computers. Performance is similar to HTML5 video playback. Also, Flash Player has been used on multiple mobile devices as a primary user interface renderer.

Compilation

Although code written in ActionScript 3 executes up to 10 times faster than the prior ActionScript 2, the Adobe ActionScript 3 compiler is a non-optimizing compiler, and produces inefficient bytecode in the resulting SWF, when compared to toolkits such as CrossBridge.

CrossBridge, a toolkit that targets C++ code to run within the Flash Player, uses the LLVM compiler to produce bytecode that runs up to 10 times faster than code the ActionScript 3 compiler produces, only because the LLVM compiler uses more aggressive optimization.

Adobe has released ActionScript Compiler 2 (ASC2) in Flex 4.7 and onwards, which improves compilation times and optimizes the generated bytecode and supports method inlining, improving its performance at runtime.

As of 2012, the Haxe multiplatform language can build programs for Flash Player that perform faster than the same application built with the Adobe Flex SDK compiler.

Development methods

Flash Player applications and games can be built in two significantly different methods:

• "Flex" applications: The Adobe Flex Framework is an integrated collection of stylable Graphical User Interface, data manipulation and networking components, and applications built upon it are termed "Flex" applications. Startup time is reduced since the Flex framework must be downloaded before the application begins, and weighs in at approximately 500KB. Editors include Adobe Flash Builder and FlashDevelop.
• "Pure ActionScript" applications: Applications built without the Flex framework allow greater flexibility and performance. Video games built for Flash Player are typically pure-Actionscript projects. Various open-source component frameworks are available for pure ActionScript projects, such as MadComponents, that provide UI Components at significantly smaller SWF file sizes.

In both methods, developers can access the full Flash Player set of functions, including text, vector graphics, bitmap graphics, video, audio, camera, microphone, and others. AIR also includes added features such as file system integration, native extensions, native desktop integration, and hardware integration with connected devices.

Development tools

Adobe provides five ways of developing applications for Flash Player:

• Adobe Flash Builder: enterprise application development and debugging
• Adobe Animate: graphic design, animation and scripting toolset
• Adobe Scout: visual profiler for performance optimization
• Apache Flex: a free SDK to compile Flash and Adobe AIR applications from source code; developed by Adobe and donated to the Apache Foundation
• CrossBridge: a free SDK to cross-compile C++ code to run in Flash Player

Third-party development environments are also available:

• FlashDevelop: an open-source Flash ActionScript IDE, which includes a debugger for AIR applications
• Powerflasher FDT: a commercial ActionScript IDE
• CodeDrive: an extension to Microsoft Visual Studio 2010 for ActionScript 3 development and debugging
• MTASC: a compiler
• Haxe: a multi-platform language

Game development

Adobe offers the free Adobe Gaming SDK, consisting (as of August 2014) of several open-source AS3 libraries built on the Flash Player Stage3D APIs for GPU-accelerated graphics:

• Away3D: GPU-accelerated 3D graphics and animation engine
• Starling: GPU-accelerated 2D graphics that mimics the Flash display list API
• Feathers: GPU-accelerated skinnable GUI library built on top of Starling
• Dragon Bones: GPU-accelerated 2D skeletal animation library

A few commercial game engines target Flash Player (Stage3D) as run-time environment, such as Unity 3D and Unreal Engine 3. Before the introduction of Stage3D, a number of older 2D engines or isometric engines like Flixel saw their heyday.

Adobe also developed the CrossBridge toolkit which cross-compiles C/C++ code to run within the Flash Player, using LLVM and GCC as compiler backends, and high-performance memory-access opcodes in the Flash Player (termed "Domain Memory") to work with in-memory data quickly. CrossBridge is targeted toward the game development industry, and includes tools for building, testing, and debugging C/C++ projects in Flash Player.

Notable online video games developed in Flash include Angry Birds, FarmVille and FarmVille 2, and AdventureQuest (started in 2002, and still active as of 2011).

Availability

Desktop platforms

The latest version of Flash Player is available for Windows XP and later, Mac OS X 10.6 and later and Linux.

Adobe Flash Player is available in four flavors:

1. The "Internet Explorer – ActiveX" version is an ActiveX control for use in Internet Explorer, its shells, and other Windows applications that support ActiveX technology. This plugin cannot be installed on Windows 8 and later, because these OSes come with their own integrated Flash Player ActiveX.
2. The "Firefox – NPAPI" version is available for Firefox as well as other applications that support NPAPI technology.
3. The "Opera and Chromium – PPAPI" version is available for Chromium and browsers based on Chromium (such as Opera) as well as other applications that support PPAPI technology. This plugin cannot be installed on Google Chrome as it comes with its own built-in Flash component.
4. The "projector" version is a standalone player that can open SWF files directly.

On February 22, 2012, Adobe announced that it would no longer release new versions of NPAPI Flash plugins for Linux, although Flash Player 11.2 would continue to receive security updates. In August 2016 Adobe announced that, beginning with version 24, it will resume offering of Flash Player for Linux for other browsers.

The Extended Support Release (ESR) of Flash Player on macOS and Windows was a version of Flash Player kept up to date with security updates, but none of the new features or bug fixes available in later versions. It has been on version 11.7 as of July 9, 2013, version 13 as of May 13, 2014, and version 18 as of August 11, 2015. Adobe has decided to discontinue the ESR branch and instead focus solely on the standard release as of August 2016.

Availability on desktop operating systems

Operating system		Latest stable version	Support status
Windows	XP and later, Server 2003 and later	Current stable version: 32.0.0.387	2001–2020
	2000	Old version, no longer maintained: 11.1.102.55 and 10.3.183.90	1999–2013
	98 and ME	Old version, no longer maintained: 9.0.289.0	1998–2011
	95 and NT 4 (IA-32)	Old version, no longer maintained: 7.0.14.0	1996–2005
macOS	10.10–10.15	Current stable version: 32.0.0.387	2014–2020
	10.9	Old version, no longer maintained: 29.0.0.171	2013–2018
	10.6–10.8 (IA-32,x64)	Old version, no longer maintained: 22.0.0.209	2009–2016
	10.5 (IA-32,x64)	Old version, no longer maintained: 10.3.183.90	2007–2013
	10.4 (IA-32,PPC)–10.5 (PPC)	Old version, no longer maintained: 10.1.102.64	2005–2011
	10.0–10.3	Old version, no longer maintained: 9.0.289.0	2001–2011
Classic Mac OS	7.6.1–9.2.2 (PowerPC)	Old version, no longer maintained: 7.0.14.0	1996–2005
	7.6.1–8.1 (68k)	Old version, no longer maintained: 5	1996–2002
Linux desktop		Current stable version: 32.0.0.387	1996–2020
Solaris		Old version, no longer maintained: 11.2.202.223 and 10.3.183.90	?–2013

Mobile platforms

Main article: Adobe Integrated Runtime

In 2011, Flash Player had emerged as the de facto standard for online video publishing on the desktop, with adaptive bitrate video streaming, DRM, and fullscreen support. On mobile devices however, after Apple refused to allow the Flash Player within the inbuilt iOS web browser, Adobe changed strategy, enabling Flash content to be delivered as native mobile applications using the Adobe Integrated Runtime.

Up until 2012, Flash Player 11 was available for the Android (ARM Cortex-A8 and above), although in June 2012, Google announced that Android 4.1 (codenamed Jelly Bean) would not support Flash by default. Starting in August 2012, Adobe no longer updates Flash for Android. In spite of this, Adobe Flash is still available to install on Android devices via Adobe's update archives (up to Android 4.3).

Flash Player is certified to be supported on a select range of mobile and tablet devices, from Acer, BlackBerry 10, Dell, HTC, Lenovo, Logitech, LG, Motorola, Samsung, Sharp, SoftBank, Sony (and Sony Ericsson), and Toshiba. As of 2012, Adobe has stopped browser-based Flash Player development for mobile browsers in favor of HTML5, however Adobe continues to support Flash content on mobile devices with the Adobe Integrated Runtime, which allows developers to publish content that runs as native applications on certain supported mobile phone platforms.

Version 9 was the most recent version available for the Linux/ARM-based Nokia 770/N800/N810 Internet tablets running Maemo OS2008, classic Mac OS and Windows 95/NT. Version 10 can be run under Windows 98/Me using KernelEx. HP offered Version 6 of the player for HP-UX. Other versions of the player have been available at some point for OS/2, Symbian OS, Palm OS, BeOS and IRIX. The Kodak Easyshare One includes Flash Player.

Adobe said it will optimize Flash for use on ARM architecture (ARMv7 and ARMv6 architectures used in the Cortex-A series of processors and in the ARM11 family) and release it in the second half of 2009. The company also stated it wants to enable Flash on NVIDIA Tegra, Texas Instruments OMAP 3 and Samsung ARMs. Beginning 2009, it was announced that Adobe would be bringing Flash to TV sets via Intel Media Processor CE 3100 before mid-2009. ARM Holdings later said it welcomes the move of Flash, because "it will transform mobile applications and it removes the claim that the desktop controls the Internet." However, as of May 2009, the expected ARM/Linux netbook devices had poor support for Web video and fragmented software base.

Among other devices, LeapFrog Enterprises provides Flash Player with their Leapster Multimedia Learning System and extended the Flash Player with touch-screen support. Sony has integrated Flash Player 6 into the PlayStation Portable's web browser via firmware version 2.70 and Flash Player 9 into the PlayStation 3's web browser in firmware version 2.50. Nintendo has integrated Flash Lite 3.1, equivalent to Flash 8, in the Internet Channel on the Wii.

The following table documents historical support for Flash Player and AIR on mobile operating systems:

Platform	Latest version
Android 2.2–4.1, ARM Cortex-A8+	Flash Player 11.1, AIR 3.1
Android 2.1	Flash Lite 3.0
iOS	Flash Player 11.1, AIR 3.1
BlackBerry 10.0–10.3.1	Flash Player 11.1, AIR 3.1
BlackBerry Tablet OS	Flash Player 11.1, AIR 3.1
Dreamcast	Flash Player 4.0
Maemo	Flash Player 9.4
PlayStation 3 with Firmware 2.50, NetFront 2.81	Flash Player 9.1 (update 3)
PSP with Firmware 2.70	Flash Player 6
Symbian OS	Flash Lite 4.0
Wii (Internet Channel)	Flash Lite 3.1
Pocket PC 2003	Flash Player 7
webOS (Palm and HP)	Flash Player 10
Windows Mobile 5	Flash Player 7

Other hardware

Some CPU emulators have been created for Flash Player, including Chip8, Commodore 64, ZX Spectrum and the Nintendo Entertainment System. They enable video games created for such platforms to run within Flash Player.

Open source

Adobe has taken steps to reduce or eliminate Flash licensing costs. For instance, the SWF file format documentation is provided free of charge after they relaxed the requirement of accepting a non-disclosure agreement to view it in 2008. Adobe also created the Open Screen Project which removes licensing fees and opens data protocols for Flash.

Adobe has also open-sourced many components relating to Flash.

• In 2006, the ActionScript Virtual Machine 2 (AVM2) which implements ActionScript 3 was donated as open-source to Mozilla Foundation, to begin work on the Tamarin virtual machine that would implement the ECMAScript 4 language standard with the help of the Mozilla community. It was released under the terms of a MPL/GPL/LGPL tri-license and includes the specification for the ActionScript bytecode format; Tamarin Project jointly managed by Mozilla and Adobe Systems It is now considered obsolete by Mozilla.
• In 2011, the Adobe Flex Framework was donated as open-source to the Apache Software Foundation and rebranded as Apache Flex. Some saw this move as Adobe abandoning Flex, and stepping away from the Flash Platform as a whole. Sources from Apache say that "Enterprise application development is no longer a focus at Adobe. At least as Flash is concerned, Adobe is concentrating on games and video.", and they conclude that "Flex Innovation is Exploding!". The donated source code included a partly developed AS3 compiler (dubbed "Falcon") and the BlazeDS set of technologies.
• In 2013, the CrossBridge C++ cross-compilation toolset was open sourced by Adobe and released on GitHub. The project was formerly termed "Alchemy" and "Flash Runtime C++ Compiler", and targeted the game development market to enable C++ video games to run in Adobe Flash Player.

Adobe has not been willing to make complete source code of the Flash Player available for free software development and even though free and open source alternatives such as Shumway and Gnash have been built, they are no longer under active development. The only fully functional third-party Flash Player is the commercially available Scaleform GFx Player, which is game development middleware designed for integration into non-Flash video games.

Criticism

Usability

In some browsers, prior Flash versions have had to be uninstalled before an updated version could be installed. However, as of version 11.2 for Windows, there are now automatic updater options. Linux is partially supported, as Adobe is cooperating with Google to implement it via Chrome web browser on all Linux platforms.

Mixing Flash applications with HTML leads to inconsistent behavior with respect to input handling (keyboard and mouse not working as they would in an HTML-only document). This is often done in web sites and can lead to poor user experience with the site.

The February 20, 2014 update to 12.0.0.70 introduced a reported bug, producing green video with sound only. This defect is related to hardware acceleration and may be overcome by disabling hardware acceleration via the Adobe settings in Firefox (accessed by right clicking within the video) or in Internet Explorer (within the Tools settings). This defect may be related to widely used graphics hardware, AMD Radeon HD video cards, and similar visual defects have occurred in earlier Flash updates, with the same workaround.

Privacy

See also: Adobe Flash § Flash cookies

Flash Player supports persistent local storage of data (also referred to as Local Shared Objects), which can be used similarly to HTTP cookies or Web Storage in web applications. Local storage in Flash Player allows websites to store non-executable data on a user's computer, such as authentication information, game high scores or saved games, server-based session identifiers, site preferences, saved work, or temporary files. Flash Player will only allow content originating from exactly the same website domain to access data saved in local storage.

Because local storage can be used to save information on a computer that is later retrieved by the same site, a site can use it to gather user statistics, similar to how HTTP cookies and Web Storage can be used. With such technologies, the possibility of building a profile based on user statistics is considered by some a potential privacy concern. Users can disable or restrict use of local storage in Flash Player through a "Settings Manager" page. These settings can be accessed from the Adobe website or by right-clicking on Flash-based content and selecting "Global Settings".

Local storage can be disabled entirely or on a site-by-site basis. Disabling local storage will block any content from saving local user information using Flash Player, but this may disable or reduce the functionality of some websites, such as saved preferences or high scores and saved progress in games.

Flash Player 10.1 and upward honor the privacy mode settings in the latest versions of the Chrome, Firefox, Internet Explorer, and Safari web browsers, such that no local storage data is saved when the browser's privacy mode is in use.

Sicherheit

See also: Adobe Flash § Security

Adobe security bulletins and advisories announce security updates, but Adobe Flash Player release notes do not disclose the security issues addressed when a release closes security holes, making it difficult to evaluate the urgency of a particular update. A version test page allows the user to check if the latest version is installed, and uninstallers may be used to ensure that old-version plugins have been uninstalled from all installed browsers.

In February 2010, Adobe officially apologized for not fixing a known vulnerability for over a year. In June 2010 Adobe announced a "critical vulnerability" in recent versions, saying there are reports that this vulnerability is being actively exploited in the wild against both Adobe Flash Player, and Adobe Reader and Acrobat. Later, in October 2010, Adobe announced another critical vulnerability, this time also affecting Android-based mobile devices. Android users have been recommended to disable Flash or make it only on demand. Subsequent security vulnerabilities also exposed Android users, such as the two critical vulnerabilities published in February 2013 or the four critical vulnerabilities published in March 2013, all of which could lead to arbitrary code execution.

Symantec's Internet Security Threat Report states that a remote code execution in Adobe Reader and Flash Player was the second most attacked vulnerability in 2009. The same report also recommended using browser extensions to disable Flash Player usage on untrusted websites. McAfee predicted that Adobe software, especially Reader and Flash, would be primary target for attacks in 2010. Adobe applications had become, at least at some point, the most popular client-software targets for attackers during the last quarter of 2009. The Kaspersky Security Network published statistics for the third quarter of 2012 showing that 47.5% of its users were affected by one or more critical vulnerabilities. The report also highlighted that "Flash Player vulnerabilities enable cybercriminals to bypass security systems integrated into the application."

Steve Jobs criticized the security of Flash Player, noting that "Symantec recently highlighted Flash for having one of the worst security records in 2009". Adobe responded by pointing out that "the Symantec Global Internet Threat Report for 2009, found that Flash Player had the second lowest number of vulnerabilities of all Internet technologies listed (which included both web plug-ins and browsers)."

On April 7, 2016, Adobe released a Flash Player patch for a zero-day memory corruption vulnerability CVE-2016-1019 that could be used to deliver malware via the Magnitude exploit kit. The vulnerability could be exploited for remote code execution.

Vendor lock-in

Flash Player 11.2 does not play certain kinds of content unless it has been digitally signed by Adobe, following a license obtained by the publisher directly from Adobe.

This move by Adobe, together with the abandonment of Flex to Apache was criticized as a way to lock out independent tool developers, in favor of Adobe's commercial tools.

This has been resolved as of January 2013, after Adobe no longer requires a license or royalty from the developer. All premium features are now classified as general availability, and can be freely used by Flash applications.

Apple controversy

Main article: Apple and Adobe Flash controversy

In April 2010, Steve Jobs, at the time CEO of Apple Inc. published an open letter explaining why Apple would not support Flash on the iPhone, iPod touch and iPad. In the letter he blamed problems with the "openness", stability, security, performance, and touchscreen integration of the Flash Player as reasons for refusing to support it. He also claimed that when one of Apple's Macintosh computers crashes, "more often than not" the cause can be attributed to Flash, and described Flash as "buggy". Adobe's CEO Shantanu Narayen responded by saying, "If Flash [is] the number one reason that Macs crash, which I'm not aware of, it has as much to do with the Apple operating system."

Steve Jobs also claimed that a large percentage of the video on the Internet is supported on iOS, since many popular video sharing websites such as YouTube have published video content in an HTML5 compatible format, enabling videos to playback in mobile web browsers even without Flash Player.

China-specific version

Starting with version 30, Adobe stopped distributing Flash Player directly to Chinese users. Instead, they selected 2144.cn as a partner and released a special version of Flash Player on a specific website, which contains a non-closable process that collects privacy information and pops up advertisement window contents. The partnership started in about 2017, but in version 30, Adobe disabled the usage of vanilla (global) version of Flash Player in China, forcing users to use that specific version, which may pose a risk to its users due to China's Internet censorship. This affects Google Chrome users using Windows 10, Internet Explorer users using Windows 7, and Firefox users using all versions of Windows, as Microsoft still directly distributes Flash Player for Internet Explorer and Microsoft Edge through Windows Update in Windows 8 and upward.

Release history

Adobe Flash Player version history

* Macromedia Flash Player 2 (June 17, 1997)

• • Mostly vectors and motion, some bitmaps, limited audio
  • Support of stereo sound, enhanced bitmap integration, buttons, the Library, and the ability to tween color changes
• Macromedia Flash Player 3 (May 31, 1998)
  • Added alpha transparency, licensed MP3 compression
  • Brought improvements to animation, playback, and publishing, as well as the introduction of simple script commands for interactivity
• Macromedia Flash Player 4 (June 15, 1999)
  • Saw the introduction of streaming MP3s and the Motion Tween. Initially, the Flash Player plug-in was not bundled with popular web browsers and users had to visit Macromedia website to download it; As of 2000, however, the Flash Player was already being distributed with all AOL, Netscape and Internet Explorer browsers. Two years later it shipped with all releases of Windows XP. The install-base of the Flash Player reached 92 percent of all Internet users.
• Macromedia Flash Player 5 (August 24, 2000)
  • A major advance in ability, with the evolution of Flash's scripting abilities as released as ActionScript
  • Saw the ability to customize the authoring environment's interface
  • Macromedia Generator was the first initiative from Macromedia to separate design from content in Flash files. Generator 2.0 was released in April 2001, and featured real-time server-side generation of Flash content in its Enterprise Edition. Generator was discontinued in 2002, in favor of new technologies such as Flash Remoting, which allows for seamless transmission of data between the server and the client, and ColdFusion Server.
  • In October 2000, usability guru Jakob Nielsen wrote a polemic article regarding usability of Flash content entitled "Flash: 99% Bad". (Macromedia later hired Nielsen to help them improve Flash usability.)

The old Macromedia Flash Player logo

• Macromedia Flash Player 6 (version 6.0.21.0, codenamed Exorcist) (March 15, 2002)
  • Support for the consuming Flash Remoting (AMF) and Web Service (SOAP)
  • Supports ondemand/live audio and video streaming (RTMP)
  • Support for screenreaders via Microsoft Active Accessibility
  • Added Sorenson Spark video codec for Flash Video
  • Support for video, application components, shared libraries, and accessibility
  • Macromedia Flash Communication Server MX, also released in 2002, allowed video to be streamed to Flash Player 6 (otherwise the video could be embedded into the Flash movie).
• Macromedia Flash Player 7 (version 7.0.14.0, codenamed Mojo) (September 10, 2003)
  • Supports progressive audio and video streaming (HTTP)
  • Supports ActionScript 2.0, an object-oriented programming language for developers
  • Ability to create charts, graphs and additional text effects with the new support for extensions (sold separately), high fidelity import of PDF and Adobe Illustrator 10 files, mobile and device development and a forms-based development environment. ActionScript 2.0 was also introduced, giving developers a formal object-oriented approach to ActionScript. V2 Components replaced Flash MX's components, being rewritten from the ground up to take advantage of ActionScript 2.0 and object-oriented principles.
  • In 2004, the "Flash Platform" was introduced. This expanded Flash to more than the Flash authoring tool. Flex 1.0 and Breeze 1.0 were released, both of which used the Flash Player as a delivery method but relied on tools other than the Flash authoring program to create Flash applications and presentations. Flash Lite 1.1 was also released, enabling mobile phones to play Flash content.
  • Last version for Windows 95/NT4 and Mac Classic
• Macromedia Flash Player 8 (version 8.0.22.0, codenamed Maelstrom) (September 13, 2005)
  • Support for runtime loading of GIF and PNG images
  • New video codec (On2 VP6)
  • Improved runtime performance and runtime bitmap caching
  • Live filters and blendmodes
  • File upload and download abilities
  • New text-rendering engine, the Saffron Type System
  • ExternalAPI subsystem introduced to replace fscommand
  • On December 3, 2005, Adobe Systems acquired Macromedia and its product portfolio (including Flash).
• Macromedia Flash Player 8 (version 8.0.24.0) (April 23, 2006)
• Adobe Flash Player 9 (version 9.0.15.0, codenamed Zaphod and formerly named Flash Player 8.5) (June 22, 2006)
  • Introduction of ActionScript Virtual Machine 2 (AVM2) with AVM1 retained for compatibility
  • ActionScript 3 (a superset of ECMAScript 3) via AVM2
  • E4X, which is a new approach to parsing XML
  • Support for binary sockets
  • Support for regular expressions and namespaces
  • AVM2 donated to Mozilla Foundation as open-source virtual machine named Tamarin
• Adobe Flash Player 9 Update 1 (version 9.0.28.0, codenamed Marvin) (November 9, 2006)
  • Support for fullscreen mode
• Adobe Flash Player 9 (version 9.0.45.0) (March 27, 2007)
  • Support for Creative Suite 3.
• Adobe Flash Player 9 Update 2 (version Mac/Windows 9.0.47.0 and Linux 9.0.48.0, codenamed Hotblack) (June 11, 2007)
  • Security Update
• Adobe Flash Player 9 Update 3 (version 9.0.115.0, codenamed Moviestar oder Frogstar) (December 2007)
  • H.264
  • AAC (HE-AAC, AAC Main Profile, and AAC-LC)
  • New Flash Video file format F4V based on the ISO base media file format (MPEG-4 Part 12)
  • Support for container formats based on the ISO base media file format
  • Last version for Windows 98/ME and other platforms
• Adobe Flash Player 10 (version 10.0.12.36, codenamed Astro) (October 15, 2008)
  • New Features
    • 3D object transformations
    • Custom filters via Pixel Bender
    • Advanced text support
    • Speex audio codec
    • Real Time Media Flow Protocol (RTMFP)
    • Dynamic sound generation
    • Vector data type
  • Enhanced Features
    • Larger bitmap support
    • Graphics drawing API
    • Context menu
    • Hardware acceleration
    • Anti-aliasing engine (Saffron 3.1)
    • Read/write clipboard access
    • WMODE
• Adobe Flash Player 10 (version 10.0.32.18) (July 27, 2009)
• Adobe Flash Player 10 (version 10.0.42.34) (November 16, 2009)
• Adobe Flash Player 10 (version 10.0.45.2) (February 21, 2010)
• Adobe Flash Player 10.1 (version 10.1.53.64, codenamed Argo) (June 10, 2010)
  • Reuse of bitmap data copies for better memory management
  • Improved garbage collector
  • Hardware-based H.264 video decoding
  • HTTP Dynamic Streaming
  • Peer-assisted networking and multicast
  • Support for browser privacy modes
  • Multi-touch APIs
  • For Macs/OSX 10.4 ppc or later
    • Using Cocoa UI for Macs
    • Use of double-buffered OpenGL context for fullscreen
    • Use of Core Animation
• Adobe Flash Player 10.2 (version 10.2.152.26, codenamed Spicy) (February 8, 2011)
  • Stage Video, a full hardware-accelerated video pipeline
  • Internet Explorer 9 hardware-accelerated rendering support
  • Custom native mouse cursors
  • Multiple monitor fullscreen support
  • Enhanced subpixel rendering for text
• Adobe Flash Player 10.2 (version 10.2.152.32) (February 28, 2011)
• Adobe Flash Player 10.2 (version 10.2.153.1) (March 21, 2011)
• Adobe Flash Player 10.2 (version 10.2.159.1) (April 15, 2011)
• Adobe Flash Player 10.3 (version 10.3.181.14, codenamed Wasabi) (May 12, 2011)
  • Media measurement (video analytics for websites; desktop only)
  • Acoustic Echo Cancellation (acoustic echo cancellation, noise suppression, voice activity detection, automatic compensation for microphone input levels; desktop only)
  • Integration with browser privacy controls for managing local storage (ClearSiteData NPAPI)
  • Native control panel
  • Auto-update notification for Mac OS X
  • Last version for Mac OS X 10.5 and Windows 2000 (unofficially bypassing the XP installer)
  • Adobe replaced Extended Support Release 10.3 by 11.7 on July 9, 2013.
• Adobe Flash Player 10.3 (version 10.3.181.23) (June 5, 2011)
• Adobe Flash Player 10.3 (version 10.3.181.26) (June 14, 2011)
• Adobe Flash Player 10.3 (version 10.3.181.34) (June 29, 2011)
• Adobe Flash Player 10.3 (version 10.3.183.5) (August 14, 2011)
• Adobe Flash Player 10.3 (version 10.3.183.7) (August 24, 2011)
• Adobe Flash Player 10.3 (version 10.3.183.10) (September 21, 2011)
• Adobe Flash Player 10.3 (version 10.3.183.11) (November 11, 2011)
• Adobe Flash Player 10.3 (version 10.3.183.25) (September 18, 2012)
• Adobe Flash Player 10.3 (version 10.3.183.29) (October 8, 2012)
• Adobe Flash Player 11 (version 11.0.1.152, codenamed Serrano) (October 4, 2011)
  • Desktop only
    • Stage 3D accelerated graphics rendering
      • Desktop: Windows (DirectX 9), OS X (Intel processor only) and Linux (OpenGL 1.3), SwiftShader fallback
      • Mobile: Android and iOS (OpenGL ES 2)
    • H.264/AVC software encoding for cameras
    • Native 64-bit
    • Asynchronous bitmap decoding
    • TLS secure sockets
  • Desktop and mobile
    • Stage Video hardware acceleration
    • Native extension libraries
      • Desktop: Windows (.dll), OS X (.framework)
      • Mobile: Android (.jar, .so), iOS (.a)
    • JPEG XR decoding
    • G.711 audio compression for telephony
    • Protected HTTP Dynamic Streaming (HDS)
    • Unlimited bitmap size
    • LZMA SWF compression
  • Mobile only
    • H.264/AAC playback
    • Front-facing camera
    • Background audio playback
    • Device speaker control
    • 16- and 32-bit color depth
• Adobe Flash Player 11.1 (version 11.1.102.55, codenamed Anza) (November 10, 2011)
  • Last version of the web browser plug-in for mobile devices (made for Android 2.2 to 4.0.3)
  • iOS 5 native extensions for AIR
  • StageText: Native text input UI for Android
  • Security enhancements, last official version for Windows 2000
• Adobe Flash Player 11.1 (version 11.1.102.62) (March 5, 2012)
• Adobe Flash Player 11.2 (version 11.2.202.228) (March 28, 2012)
• Adobe Flash Player 11.2 (version 11.2.202.233) (April 12, 2012)
• Adobe Flash Player 11.2 (version 11.2.202.235, codenamed Brannan) (May 3, 2012)
  • The Windows version offers automatic updater options
  • Dropped support of the browser plug-in for mobile devices (Android). Android app developers are encouraged to use Adobe Air and Android web developers should switch to HTML5.
  • Extended support for Flash player 11.2 on Solaris as it is the last version to be supported.
  • Adobe replaced Extended Support Release 11.2 on Linux with 24.0 on December 13, 2016.
• Adobe Flash Player 11.3 (version 11.3.300.257) (June 8, 2012)
• Adobe Flash Player 11.3 (version 11.3.300.262) (June 21, 2012)
• Adobe Flash Player 11.3 (version 11.3.300.265) (July 11, 2012)
• Adobe Flash Player 11.3 (version 11.3.300.268) (July 26, 2012)
• Adobe Flash Player 11.3 (version 11.3.300.270) (August 4, 2012)
  • Desktop and mobile
    • Fullscreen interactive mode (keyboard input during fullscreen)
    • Native bitmap encoding and compression (PNG, JPEG, JPEG-XR)
    • Draw bitmaps with quality (low, medium, high, best)
    • Texture streaming for Stage3D
    • Dropped support for Linux and Solaris
  • Mobile-only
    • Auto-orientation on specific devices
    • USB debugging for AIR on iOS
• Adobe Flash Player 11.3 (version 11.3.300.271) (September 18, 2012)
• Adobe Flash Player 11.3 (version 11.3.300.273) (October 3, 2012)
• Adobe Flash Player 11.4 (version 11.4.402.259) (August 10, 2012)
  • Flash Player only
    • ActionScript workers
    • SandboxBridge support
    • Licensing support: Flash Player Premium features for gaming
  • Flash Player and AIR
    • Stage3D "constrained" profile for increased GPU reach
    • LZMA support for ByteArray
    • StageVideo attachCamera/Camera improvements
    • Compressed texture with alpha support for Stage3D
    • DXT encoding
  • AIR only
    • Deprecated Carbon APIs for AIR
    • Direct AIR deployment using ADT
    • Push notifications for iOS
    • Ambient AudioPlaybackMode
    • Exception support in Native Extensions for iOS
• Adobe Flash Player 11.4 (version 11.4.402.265) (August 21, 2012)
• Adobe Flash Player 11.4 (version 11.4.402.278) (September 18, 2012)
• Adobe Flash Player 11.4 (version 11.4.402.287) (October 8, 2012)
• Adobe Flash Player 11.5
  • Shared ByteArray
  • Invoke Event enhancement (for openurl)
  • Packaging multiple libraries in an ANE (iOS)
  • Debug stack trace in release builds of Flash Player
  • Statically link DRM (desktop only)
• Adobe Flash Player 11.6 (codenamed Folsom)
  • Lossless video export from standalone and authplay.dll
  • Support for flash.display.graphics.readGraphicsData() that returns a Vector of IGraphicsData
  • Improve permissions UI related to full screen keyboard access
  • Prevent ActiveX abuse in Office documents
  • Support file access in cloud on Windows
  • Enhance multi-SWF support
  • Migration certification for ANEs
  • RectangleTexture
  • File API update so AIR apps conform to Apple data storage guidelines
  • Separate sampler state for Stage3D
  • Set device specific Retina Display resolution (iOS)
• Adobe Flash Player 11.7 (version 11.7.700.169, codenamed Geary) (April 9, 2013)
  • SharedObject.preventBackup property
  • forceCPURenderModeForDevices
  • Remote hosting of SWF files in case of multiple SWFs
  • Support for uploading 16-bit texture formats
  • GameInput updates
  • Android – create captive runtime apps
  • Adobe replaced Extended Support Release 11.7 on Mac and Windows with 13.0 on May 13, 2014.
• Adobe Flash Player 11.8 (codenamed Harrison)
  • Stage3D baselineExtended profile
  • Recursive stop on MovieClip
  • Flash Player & AIR Desktop Game Pad Support
  • Support for large textures (extendedBaseline, 4096)
  • Rectangle texture
  • DatagramSocket
  • ServerSocket
  • Substitute a redirected URL from a source URLRequest for part of the URL in a new URLRequest
• Adobe Flash Player 11.9 (codenamed Irving)
  • OS X Mavericks Support
  • Mac .pkg Installation Support
• Adobe Flash Player 12 (codenamed Jones)
  • Improved Mac .pkg Installation Support for the work flow and UI
  • Support for Internet Explorer 11 on Windows 7
  • Support for Safe Mode in Safari 6.1 and higher
  • 64-bit PPAPI Flash Player for Google Chrome
  • Graphics: Buffer Usage flag for Stage3D
• Adobe Flash Player 13 (codenamed King)
  • Supplementary Characters Enhancement Support for Text Field
  • Full Screen video message tweak
  • As of 13 May 2014 this is the Extended Support Release.
• Adobe Flash Player 14 (version 14.0.0.125, codenamed Lombard) (June 10, 2014)
  • Stage 3D Standard profile
• Adobe Flash Player 14 (version 14.0.0.145) (July 8, 2014)
• Adobe Flash Player 14 (version 14.0.0.179) (August 12, 2014)
• Adobe Flash Player 15 (version 15.0.0.152, codenamed Market) (September 9, 2014)
  • Improved support for browser zoom levels
• Adobe Flash Player 15 (version 15.0.0.167) (September 24, 2014)
• Adobe Flash Player 15 (version 15.0.0.223) (November 11, 2014)
• Adobe Flash Player 15 (version 15.0.0.239) (November 25, 2014)
• Adobe Flash Player 16 (version 16.0.0.235, codenamed Natoma) (December 12, 2014)
  • Stage3D – Standard Constrained Profile
  • PPAPI Installers for Windows and Mac
• Adobe Flash Player 16 (version 16.0.0.257) (January 13, 2015)
• Adobe Flash Player 16 (version 16.0.0.287) (January 22, 2015)
• Adobe Flash Player 17 (version 17.0.0.134, codenamed Octavia) (March 12, 2015)
  • Control Panel improvements
  • Installer improvements for Mac
• Adobe Flash Player 18 (version 18.0.0.160, codenamed Presidio) (June 9, 2015)
  • Contains fixes for Adobe Security Bulletin APSB 15–11
• Adobe Flash Player 19 (version 19.0.0.185, codenamed Quint) (September 21, 2015)
• Adobe Flash Player 20 (version 20.0.0.228, codenamed Rankin) (December 8, 2015)
• Adobe Flash Player 21 (version 21.0.0.182, codenamed Sutter) (March 10, 2016)
• Adobe Flash Player 22 (version 22.0.0.192, codenamed Townsend) (June 16, 2016)
• Adobe Flash Player 23 (version 23.0.0.164, codenamed Underwood) (September 13, 2016)
• Adobe Flash Player 24 (version 24.0.0.186, codenamed Van Ness) (December 13, 2016)
• Adobe Flash Player 24 (version 24.0.0.194) (January 10, 2017)
• Adobe Flash Player 25 (version 25.0.0.127, codenamed Webster) (March 14, 2017)
• Adobe Flash Player 25 (version 25.0.0.148) (April 11, 2017)
• Adobe Flash Player 25 (version 25.0.0.163) (April 20, 2017)
• Adobe Flash Player 26 (version 26.0.0.131, codenamed York) (June 13, 2017)
• Adobe Flash Player 27 (version 27.0.0.130, codenamed Zoe) (September 12, 2017)
• Adobe Flash Player 27 (version 27.0.0.159) (October 10, 2017)
• Adobe Flash Player 28 (version 28.0.0.11, codenamed Atka) (November 16, 2017)
• Adobe Flash Player 29 (version 29.0.0.126) (December 12, 2017)
• Adobe Flash Player 30 (version 30.0.0.113) (June 7, 2018)
• Adobe Flash Player 31 (version 31.0.0.108) (September 11, 2018)
• Adobe Flash Player 32 (version 32.0.0.101) (December 5, 2018)
• Adobe Flash Player 32 (version 32.0.0.114) (January 8, 2019)
• Adobe Flash Player 32 (version 32.0.0.142) (February 12, 2019)
• Adobe Flash Player 32 (version 32.0.0.156) (March 12, 2019)
• Adobe Flash Player 32 (version 32.0.0.171) (April 9, 2019)
• Adobe Flash Player 32 (version 32.0.0.192) (May 14, 2019)
• Adobe Flash Player 32 (version 32.0.0.207) (June 11, 2019)
• Adobe Flash Player 32 (version 32.0.0.223) (July 9, 2019)
• Adobe Flash Player 32 (version 32.0.0.238) (August 13, 2019)
• Adobe Flash Player 32 (version 32.0.0.255) (September 10, 2019)
• Adobe Flash Player 32 (version 32.0.0.270) (October 9, 2019)
• Adobe Flash Player 32 (version 32.0.0.293) (November 13, 2019)
• Adobe Flash Player 32 (version 32.0.0.303) (December 10, 2019)
• Adobe Flash Player 32 (version 32.0.0.314) (January 14, 2020)
• Adobe Flash Player 32 (version 32.0.0.321) (January 21, 2020)
• Adobe Flash Player 32 (version 32.0.0.330) (February 11, 2020)
• Adobe Flash Player 32 (version 32.0.0.344) (March 11, 2020)
• Adobe Flash Player 32 (version 32.0.0.363) (April 14, 2020)
• Adobe Flash Player 32 (version 32.0.0.371) (May 12, 2020)
• Adobe Flash Player 32 (version 32.0.0.387) (June 9, 2020)

See also

• Adobe AIR
• Adobe Shockwave
• Apache Flex
• Microsoft Silverlight

Further reading

• Understanding Flash Player with Adobe Scout – an article discussing the internals of the player and the Adobe Scout profiling tool

External links

• Official website
• Flash Tester (explains official old working version check)