Adobe Flash Player reached end of life in December 2020, and current versions of Google Chrome no longer support or enable it by default. If you are updating Flash Player in Chrome today, the practical step is to confirm that any remaining Flash content is migrated to open, secure formats and to remove Flash components from your device. This article explains the status of Flash in Chrome, associated risks, how to audit and clean legacy settings, and reliable evergreen alternatives for video, interactive content, and streaming.
Current status of Flash Player in Chrome
As of 2021, Chrome does not include Flash Player in the default build, and no public updates are provided. The browser will not enable Flash by default for any site, and users must explicitly permit Flash on a per-site basis only if a local Flash plugin exists. In practice, most users will see no Flash content at all, and enterprise policies can be used to fully disable or block Flash where required. Modern HTML5, WebAssembly, MSE/DASH, and WebRTC handle the use cases Flash once served, with better performance, security, and privacy.
Key dates and milestones
| Date or Period | Event | Why It Matters |
|---|---|---|
| July 2017 | Chrome begins phased deprecation of Flash | HTML5 becomes default; Flash click-to-play required |
| December 2020 | Adobe Flash Player end of life (EOL) | No further security updates from Adobe |
| 2020–2021 | Chrome ships without Flash; site access blocked by default | Reduced attack surface and maintenance burden |
| 2021 onward | Chrome blocks all Flash content | Sites must serve modern formats (HTML5/MP4/WebM) |
Security and compatibility risks of using Flash
Flash Player after EOL has no security patches, which means known vulnerabilities remain exploitable. Attackers have historically used Flash exploits for drive-by downloads and credential theft. Browsers restrict Flash by default for this reason, and many sites no longer test or support it. If you encounter legacy Flash content, the safest path is to convert it to HTML5 or contact the content provider for an updated version. Running outdated plugins introduces malware risk and compliance concerns, especially in regulated environments.
How to audit and remove Flash settings in Chrome
If you are responsible for Chrome deployments, audit Flash usage before deciding whether to keep, block, or remove it. Modern policy-based management via browser policies ensures consistent behavior across devices and users. The steps below cover checking local settings, site exceptions, and enforcing secure configurations that align with current best practice.
Audit and list Flash usage
- In Chrome, open Settings > Privacy and security > Site Settings > Flash and review allowed sites.
- Check enterprise policies (for Chrome Browser Cloud Management) for Flash default behavior.
- Export logs or use device statistics to identify legacy content still attempting to load Flash.
- Inventory known internal apps or vendor portals that may require migration planning.
Recommended remediation steps
- Block Flash via policy so users cannot inadvertently enable it.
- Contact content owners to obtain HTML5 or app-based alternatives.
- Remove local Flash installations if no longer required; if reinstalling for legacy access, isolate the environment and restrict network access.
- Monitor for exceptions and periodically review allowlists to ensure only essential, tested content is permitted.
Verifying and updating enterprise policies for Flash
Organizations using Chrome Enterprise can enforce Flash controls through policy templates. Policies exist to block Flash entirely, to ask before running Flash, or to allow specific origins that still require legacy support. When updating policies, prefer denying Flash by default and whitelisting only validated exceptions with a documented sunset date. Regular review of these policies reduces long-term risk and keeps the browsing environment aligned with current threat landscapes.
Policy configuration guidance
- Set FlashBlockEnabled to true to block by default.
- Use AdditionalBlockedFlashOrigins to prevent accidental enables.
- Document any allowed origins and assign an owner responsible for timely migration.
- Periodically audit policy compliance and exceptions using Admin Reports.
Modern, supported alternatives to Flash in Chrome
Today’s web platform natively handles interactive media, animations, video, and real-time communication. Open standards are performant, energy-efficient, and supported across browsers and devices, making them a durable choice for content publishers and developers.
Replacements for common Flash use cases
| Use case | Flash (legacy) | Modern alternative |
|---|---|---|
| Video playback | Flash Video (FLV/F4V) | HTML5 video with MP4/WebM, HLS/DASH |
| Rich interactivity | ActionScript/Flash apps | WebGL, Canvas, WebAssembly, JavaScript frameworks |
| Advertising | Flash ads | HTML5 ads, IAB standards, AMP ads |
| Streaming and live | Flash RTMP | WebRTC, HLS, MPEG-DASH, SRT |
| Enterprise legacy apps | Flash desktop integrations | Progressive Web Apps, Electron, native clients |
Practical migration checklist for Flash content
Transitioning from Flash to modern formats reduces maintenance, improves security, and ensures compatibility with current browsers. Plan small, test thoroughly, and communicate changes to users who may rely on legacy workflows. The checklist below provides a concise, actionable path for teams managing Flash-to-modern migrations.
- Inventory all Flash-based content, ads, and internal tools.
- Confirm business purpose and whether the content is still needed.
- Rebuild or rehost using HTML5, CSS, and JavaScript frameworks.
- Validate functionality and accessibility across target browsers and devices.
- Update hosting and delivery to use HTTPS and efficient streaming protocols.
- Update internal documentation, vendor instructions, and user guides.
- Monitor analytics to confirm adoption and detect broken experiences.
FAQ
Reader questions
Can I still install Flash Player in Chrome?
Chrome does not offer Flash through the standard browser download. If you require Flash for a legacy, isolated environment, you should run it in a controlled virtual machine or specialized browser, never in the primary production browsing profile.
What happens if I encounter a site that still requires Flash?
Most legitimate sites have migrated. If a site still claims Flash is necessary, contact the provider and request an HTML5 version. Continuing to use Flash introduces security and compatibility risk; consider alternative services or vendors that support modern technologies.
Do I need to keep Flash for enterprise line-of-business apps?
Evaluate each app individually, but plan to replace or containerize legacy Flash components. Use enterprise policies to block Flash by default and provide temporary, isolated access only where essential, with a clear deprecation plan.
Are there performance differences between Flash and modern players?
Modern HTML5 players and codecs are generally more efficient, use less CPU and battery, and offer better integration with responsive design and adaptive streaming. In most cases, migration improves user experience and reduces operational costs.