I think the same thing would have resulted from almost any closed-source binary parsing remote data deployed on a huge number of different browsers. Flash, Java

I think the same thing would have resulted from almost any closed-source binary parsing remote data deployed on a huge number of different browsers. Flash, Java, and Adobe Reader, present almost uniquely-attractive attack surfaces due to their cross-browser ubiquity as well as their fragility. That isn't making excuses for them, of course, but it gives us an important data point as to what behaviour to avoid in future. (I'm looking at you, Silverlight.)