It's very important to note that click to play for Flash in Chrome is NOT a security feature. Sites can bypass it. To quote a Chrome developer: "Click to play

It's very important to note that click to play for Flash in Chrome is NOT a security feature. Sites can bypass it. To quote a Chrome developer: "Click to play is not actually a security boundary. In particular, it has always been subject to click-jacking." https://code.google.com/p/chromium/issues/detail?id=174963 https://code.google.com/p/chromium/issues/detail?id=174963