Chrome Browser to Start Sandboxing Flash Player
The latest developer channel release of the Chrome browser now supports sandboxing for Adobe's Flash Player on Windows 7, Vista and XP. — This feature should provide extra protection against malicious browser exploits through the Flash Player.
Context & Ripple Effects
Adobe enters December 2010 under pressure on multiple fronts: its CEO has framed the company's public fight with Apple over Flash as part of a broader 'war' between device and software makers for developers, while Flash itself keeps generating bad technical headlines — a report that the plugin drains the new MacBook Air's battery by several hours and poor performance on Samsung's Galaxy Tab described as an embarrassing disaster.
Google's move in this release cuts differently: rather than attacking Flash's place in the browser, Chrome is containing it. Sandboxing the player on Windows 7, Vista and XP treats Flash as untrusted code by default — a security framing that gives Adobe a defensive win at exactly the moment its platform story is under attack.
First-order effects
- Windows users on Chrome's developer channel get exploit protection immediately: malicious code delivered through Flash Player is now confined by the sandbox instead of running with full browser privileges.
- Adobe gains a concrete security talking point against the narrative building around Flash's flaws — battery drain on Apple hardware and weak tablet performance — at no cost of its own engineering.
Second-order effects
- Rival browser makers face pressure to match Chrome's plugin-containment approach, since leaving Flash unsandboxed becomes a visible security gap rather than a neutral design choice.
- Attack economics shift toward whatever plugins remain outside sandboxes, pushing the exploit market — and defenders' attention — toward less-hardened browser components.
Third-order effects
- If plugin sandboxing becomes table stakes, the long-run structure of the web points toward browsers as security boundaries that assume all embedded code is hostile, with plugin vendors' relevance increasingly set by how well their runtime survives containment.
- The pattern reinforces the broader contest Adobe's CEO described between device/software makers over who controls applications on consumer devices — with security architecture, not just developer relations, becoming a battleground.
The trend: Browsers are evolving from passive hosts into hardened containers that isolate third-party runtimes like Flash as untrusted code, shifting control over web security from plugin vendors to browser makers.