Adobe Flash Player may no longer be popular as it was before. But, according to a report by Czech antivirus provider Avast, the plugin remains to be one of the most downloaded and installed programs on PC.

Avast has published its PC Trends Report for Q1 2017, which has been created using the data obtained from 116 million Windows users. Using this data, Avast ranked numerous programs according to the number of active installs and found out that Adobe Flash Player Active X gained the third spot while the Flash Player Plugin was ranked fifth. (Google Chrome took the top spot, followed by Adobe Reader in second place).

There are several reasons why Adobe Flash Player got on the top five. Google Chrome now blocks Flash Player by default, and users might be downloading the plugin instead of simply enabling it in Chrome’s Settings. More people might also be accessing content that requires Flash Player, which means they have no choice but to install it in their PCs.

But, even though Flash Player is one of the most installed programs, it’s also one of the least updated applications. In fact, the Flash ActiveX Control for Internet Explorer gained the number two spot on the list since 99 percent of the installed version in people’s devices were outdated. It’s second only to Java Runtime 6 and 7, which are already out of date considering that Java Runtime Environment 8 is now available. Even those who are using Java Runtime 8 have not downloaded the newest release; Avast discovered that only 30 percent of users have updated this program and are running on the latest version.

This is bad news since Flash Player is notorious for its security vulnerabilities that hackers can easily take advantage of. Adobe is doing its best to release security patches as quickly as possible to maintain user safety and security, which means that the latest versions of the program can protect users from known threats. By failing to download these updates, you’re putting yourself at risk for phishing, data theft, and malware and ransomware infections.

You can check out Avast’s full report here.