Chrome Insider: Preparing your enterprise for Flash deprecation

It’s been almost three years since Adobe announced plans to stop supporting Flash (and Google followed with its plan for phasing out Flash). Flash is set to be completely removed from Chrome by the end of 2020, so businesses should get ready by identifying and modifying their internal and external sites to migrate off of Flash technologies.

The move away from Flash has been welcomed by security-conscious admins, but keeping track of internal and external websites can be tricky. To help with this task, admins can use the Chrome Reporting Extension to start identifying all the websites that will need modifications and begin working with those site owners to update their code. The extension can be deployed via Chrome Browser Cloud Management or GPO policies. Follow the steps below to use this extension to gather a list of sites that use Flash technologies.

Install and configure the extension

1. Use the Group Policy Management Editor or Chrome Browser Cloud Management console to force-install the Chrome Reporting Extension. See detailed steps for force-installing the extension.

2. Download the Chrome Reporting Extension MSI.

3. Deploy the MSI package using your preferred software.

4. Download the Chrome Reporting Extension ADMX templates to turn on real-time reporting.

5. Turn on the “Report the User Browsing Behavior Information” policy. This identifies the websites users are browsing to and whether they use any legacy technology. 

• Please follow your enterprise policies regarding the notification of users that their browsing history is collected.

6. Check that the %LOCALAPPDATA%\Google\ChromeReporting path was created to verify the MSI installation.

7. Verify the extension was installed on users’ computers. 

• The Chrome Web Store ID is emahakmocgideepebncgnmlmliepgpgb. 

You can easily view this and all installed extensions within your enterprise in Chrome Browser Cloud Management under the browser extension list. For more information about managing extensions in the console, check out this help article.

Gather data

1. Let the extension run for at least a few days to allow for any variability in the sites users navigate to.The browsing data is written to the logs every hour.

• There might be a delay from when the users navigate to sites until the data shows up in the logs as data is aggregated over a period of one hour to provide not only qualitative but also quantitative information about the sites’ usage.

2. Once the data gathering period is over, use your preferred software to pull the logs from the users’ machines. 

• The logs will be found at the “%LocalAppData%\Google\ChromeReporting” path and will be a JSON file type.

• As an alternative, you can enable the “Write Logging Data to the Event Log” policy to write to the WIndows Event log. 

Analyze data

Once you have gathered all the data, use your favorite data visualization/analysis tool to look for entries in the log that contain the property “legacy_technologies”:[“flash”]. Here is an example of a log entry that shows the site that uses flash:

{"url":"https://www.ultrasounds.com/US.html","legacy_technologies":["flash","activeX"],"legacy_technologies_node_attributes":{"flash":["type:application/x-shockwave-flash","src:US.swf"],"activeX":["classid:clsid:D27CDB6E-AE6D-11cf-96B8-444553540000"]},"active_duration":4102,"focused_duration":4102}],"version":1,"id":132}

In the log entry above, you can see the URL that was accessed, the legacy technology it was using, the time the site was loaded in a tab, and the amount of time the user focused on it, or had mouse or keyboard events.

Be aware that all URLs accessed in a certain period of time are written in an entry spanning one line in the log file, so you will need to parse the data accordingly. 

If you prefer to programmatically analyze the data, here’s an example of a Python script you can use to find all occurrences of Flash websites in a JSON file:

An example output of the script would look like this:

Upcoming changes to Flash notifications and enterprise controls

While the steps above offer a great way for enterprises to map out their journey off of Flash, Google will continue to make some changes to how it handles Flash in Chrome and some of the available controls.

Starting with version 83, Chrome will add a warning text to the activation prompt for Flash Player,  highlighting the industry wide end-of-support date (December 2020) with a link to learn more. The new notification will be shown to all users, even if Flash is enabled by enterprise policy.

In an upcoming version of Chrome, wildcards will no longer be supported for the PluginsAllowedForUrls policy. Admins using wildcards in the policy will need to switch to specific whitelists for any sites that are still using Flash. Extensions that attempt to enable Flash using wildcards will also not be supported. These changes are intended to help admins narrow down which sites still require updating, with enough time to adjust before support for Flash is removed completely in December 2020. 

Using the tips listed above will help admins create the whitelist as wildcards are removed, and support their overall move away from Flash with minimal disruption to their users.