Microsoft Edge allows Facebook to run Flash content without user approval

Despite security policies requiring user permission for websites to run Flash content, Microsoft Edge has a hidden whitelist that allows Facebook to run Flash code without consent.

As first reported by ZDNet, the whitelist was discovered by Google Project Zero security researcher Ivan Fratic, who also found security flaws involving the whitelist. The flaws include:

  • An XSS vulnerability on any of the domains would allow bypassing click2play policy [and running malicious Flash code on these domains].
  • There are already publicly known and unpatched instances of XSS vulnerabilities on at least some of the whitelisted domains.
  • The whitelist is not limited to https. Even in the absence of an XSS vulnerability, this would allow a MITM attacker to bypass the click2play policy.

Microsoft Edge currently relies on a click-to-play policy for Flash, which explicitly requires users permission to run any Flash-based content. The secret whitelist allows Facebook to bypass this policy for Flash widgets sized at over 398x298 pixels and are hosted on https://www.facebook.com and https://apps.facebook.com. As ZDNet speculates, this is likely so that Edge will continue to support Facebook's legacy collection of Flash games. However, when reached for comment, Facebook told ZDNet that it never asked Microsoft to be added to a whitelist and it has since requested Microsoft to be excluded from the list.

While the two Facebook domains are the only ones currently included on the whitelist, it was much bigger prior to February. When it was originally discovered, the list contained a total of 58 URLs, including entries for Microsoft's own site, along with Deezer, Yahoo, and more. After the list's discovery, Fratric filed a bug report with Microsoft in November. The whitelist was pared down to the two Facebook URLs with this month's "Patch Tuesday" updates.

While Microsoft didn't comment on the list directly, the company told ZDNet in a statement: "We are nearing the point where Flash is no longer part of the default experience in Microsoft Edge on any site and the recent changes in February were the next step of the transition plan."

Due to security concerns, all major browsers have implemented "click-to-play" policies regarding Flash content. Adobe, the company behind Flash, has outlined plans to retire it by 2020. Microsoft, meanwhile, has announced plans to switch Edge from its own EdgeHTML engine to Chromium.

Latest And Best Prime Day Deals

Unlock voice control with Echo device deals and $5 Amazon smart plugs
Amazon Echo devices bundled with $5 smart plugs

Amazon's Smart Plug lets you start voice controlling anything plugged into it by asking an Alexa-compatible device, and today's deal lets you snag one for only $5 with purchase of select Echo devices.

Be more productive with a year of Office 365 Home and a free $50 Amazon gift card
Office 365 Home 12-month subscription and $50 Amazon gift card
$99.99 $150.00 Save $50

The subscription works with up to six people, but that card can be all yours.

Amazon's Fire TV Cube is down to just $70 thanks to this Prime Day deal
Amazon Fire TV Cube
$69.99 $119.99 Save $50

Grab TCL's 32-inch 720p Roku TV for less than $100 in this Prime Day Lightning deal
TCL 32S325 32-inch 720p Roku TV
$99.99 $130.00 Save $30

Act fast while you can. These Lightning deals tend to sell out quick.

The Ring Alarm security system is reaching new low prices for Prime Day
Ring Alarm home security systems

Various configurations of the Ring Alarm are discounted to their best prices yet exclusively for Prime members at Amazon through Tuesday night to help keep your home secure.

The Sonos Beam Prime Day deal includes a $40 discount and 2 $50 Amazon gift cards
The Sonos Beam Prime Day deal includes a $40 discount and $100 in Amazon gift cards
$359.00 $499.00 Save $140

That's just so much savings in one deal. You'll have to wait for the physical gift cards, but that's basically $100 to spend however you want.

Prime Day dropped this PlayStation 4 console bundle to just $250
PlayStation 4 Slim 1TB console with Marvel's Spider-Man and Horizon Zero Dawn
$249.99 $359.98 Save $110

This deal on the PlayStation 4 Slim console saves you $50 off its regular price while also including Marvel's Spider-Man and Horizon Zero Dawn Complete Edition for free. You'll just need an Amazon Prime membership to snag it.

The newest device in the Echo family, the Show 5, is now down to just $50
Echo Show 5
$49.99 $89.99 Save $40

It's only been on the market since May, but it hasn't escaped the Prime Day price cuts.

More Prime Day Deals