Flash is one of the most abused pieces of software in use. Flexera Software's Vulnerability Review 2016 counts 457 vulnerabilities in 2014 and 2015 (second only to Chrome with 516 vulnerabilities). But Flash is the attacker's tool of choice. For example, as recently as late May 2016 Malwarebytes reported on a malvertising campaign exploiting Flash and redirecting users to the Angler exploit kit.
Such abuse is behind current browser campaigns to deprecate the use of Flash while browsing. In April 2016 Microsoft announced that Flash content not central to the page itself (such as games) would be automatically paused in Windows 10 (Edge browser). The intent is to spur the adoption of HTML5 for animated content. In May 2016 Google announced that it would deprecate Flash and promote HTML5 within Chrome by the end of this year.
Such actions are likely to fuel a move from Flash to HTML5 for the display of web-delivered advertising. This, however, will have little effect on preventing malvertising.
A recent report from GeoEdge, an ad scanning vendor, compares the two options. This report suggests that there are technical advantages and disadvantages in both. For example, Flash can provide better clarity with its sub-pixel support, but doesn't automatically scale to the window size as does HTML5. Flash requires greater processing power, but HTML5 adverts come in at a larger size (approximately 100kb bigger).
