This bug came out of a conversation with Nicolas Joly. I don't feel comfortable claiming any credit but I'll happily take on the co-ordination.
i.e. please credit simply "Nicolas Joly"

This is extremely similar to https://code.google.com/p/google-security-research/issues/detail?id=46

The main difference is that in order to trigger the bug, it is necessary for the user to click through the camera permission dialog, which lowers the severity.

Source and compiled SWF attached. Faults my Chrome Linux x64 every time, Flash v15.0.0.152.

Note that you'll need to click "ok" on all the permission dialogs before a timer fires at the 2 second mark. If you miss, just refresh and try again.


This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

 

CameraCopyToByteArrayBug.swf 898 bytes Download

CameraCopyToByteArrayBug.as 942 bytes Download