Unfortunately, the most recent version of Flash is known to be vulnerable and there is no update. Can you live with click-to-play for a few days until Adobe issues a new plugin? If you are not accustomed to using the "Ask to Activate" feature for a plugin, here's what to expect: When you visit a site that wants to use the Flash, you should see a notification icon in the address bar and one of the following: a link in a black rectangle in the page or an infobar sliding down between the toolbar area and the page. If you see a good reason to use Flash, and the site looks trustworthy, you can go ahead and click the Lego-like icon in the address bar to allow Flash. But the page might be using Flash only for tracking or playing a video ad. If you don't see an immediate need for Flash, feel free to ignore the notification, it will just sit there in case you want it later.