It's no secret that 2015 was a rough year, security-wise, for Adobe's Flash Player. Aside from Adobe itself beginning to essentially deprecate Flash development largely due to Flash Player's longstanding status a primary target for attackers, the vulnerability report and security update stats tell a tale. The relevant page on Adobe's site lists 22 separate days on which it pushed out patches for Flash Player, including a sizable number of out-of-band releases to fix zero-days. (Like the Hacking Team zero-days. And the Pawn Storm zero-day. And the Christmas zero-day.) The National Vulnerability Database lists 330 discrete CVE ids that were issued for reported Flash Player vulnerabilities in 2015. Not fun numbers.
But the baffling thing to me is less that so many vulnerabilities were found in Flash Player in 2015 and more that so many more vulnerabilities were found in it in 2015 than in previous years. According to the NVD, in 2013 56 CVEs were issued for Flash Player vulnerabilities. In 2014, the number increased somewhat to 74. But going from 74 to 330 is an astonishing jump.
So what was behind that dramatic surge last year? The only hypothetical factors that have occurred to my mind were (a) chance, (b) some major change in the way Adobe defines separate vulnerabilities, and (c) some shift in the focus of security researchers to hunting for Flash Player vulns as targets like Java client and Windows have (arguably) been hardened. But those are just wild, pseudo-educated guesses that even I don't find terribly compelling. Does anyone have anything more solid about why the number of Flash Player vulnerabilities/zero-days/patches exploded last year?