Fix cross-domain security issue related to flash