The fundamental Adobe Flash bug will not be fixed

Security experts from Foreground Security have discovered a problem with Adobe Flash that affects almost all sites that support the loading of custom content, even if the site itself does not formally show Flash. The fact is that nothing prevents you from making object / embed on any page that is not related to the site, because Flash has access to the cookie of the domain from which it is loaded (and not where the object tag is located).

The problem lies in the ActionScript property same-origin, which allows the execution of active content within this domain. But if UGC can be downloaded to a trusted site, then the malicious script will be executed for all visitors to this site who have Flash installed.

The Adobe company said that it is very difficult to fix the bug and shifted all responsibility for protection against malicious code to the site administrators. It is recommended to allocate a separate domain for UGC storage. But this is not always possible: even the website of the Adobe company itself is subject to this vulnerability .
')
The attack can also be carried out via Gmail (see video).