3 thoughts: First, to be fair, "Flash" is 2 complete Virtual Machines: ActionScript 2 and ActionScript 3. I expect it to have an increased attack surface. Sec

3 thoughts: First, to be fair, "Flash" is 2 complete Virtual Machines: ActionScript 2 and ActionScript 3. I expect it to have an increased attack surface. Second, many things that Flash does (graphics, 3D, video decoding, audio decoding, etc) pretty quickly get you to unmanaged APIs in the OS. Third, Flash can be suprisingly tricky to escape. Mark Dowd did an absolutely insane series of steps to have code that was valid bytecode, that retained control of a pointer, and to properly setup the memory space for jumping. This isn't necessarily "easy" by any stretch. The full write up is here: http://www.inf.fu-berlin.de/groups/ag-si/compsec_assign/Dowd2008.pdf http://www.inf.fu-berlin.de/groups/ag-si/compsec_assign/Dowd... This isn't to give Adobe a complete pass, but there is a lot going on here. Still, the time for Flash is past and I cannot wait for it to die