Adobe Flash - URLStream.readObject Use-After-Free

Adobe Flash - URLStream.readObject Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=611 There is a use-after-free in URLStream.readObject. If the object read is a registered class, the constructor will get invoked to create the object. If the constructor calls...