File Under: Browsers

Microsoft, Adobe Working to Secure Flash in IE 10

Windows 8. Photo: Microsoft

If you’ve been testing the built-in version of Internet Explorer in Microsoft’s coming Windows 8, you may be vulnerable to security flaws in Adobe’s Flash plugin.

Like Google Chrome, IE 10 on Windows 8 bundles the Flash Player directly into the browser. Unlike Google Chrome, IE 10 isn’t yet getting Flash updates on time. Because the plugin is bundled Adobe’s auto-update tools don’t work, nor can users manually download and install updates.

The only way to update Flash in Windows 8 is through Windows Update. That means the job of making sure those updates get to users falls to Microsoft, which so far has not delivered.

A Microsoft spokesperson tells Webmonkey that the company is “working closely with Adobe to release an update for Adobe Flash in IE 10 to protect our mutual customers.” However, Adobe’s latest round of patches was released August 21 and there’s still been no update for IE 10 users. Microsoft says that the update will be available “shortly.”

The company also assures Webmonkey that this issue will be worked out before Windows 8 actually ships.

Part of the problem appears to simply be scheduling. Microsoft’s updates are generally released on the second Tuesday of each month, while Adobe typically patches Flash a week or two later. That window between updates is what currently leaves those testing Windows 8 vulnerable.

Microsoft tells Webmonkey that a plan is in the works to address the scheduling conflict and ensure that Windows 8 users don’t have a vulnerable version of Flash for two weeks every patch cycle. Microsoft didn’t offered any details beyond saying the company plans to “align our release schedule as closely to Adobe’s as possible.”