Reading commit messages from Chrome's support[1][2][3] for win32k system call disable mitigation (aka win32k lockdown) on Windows (specifically for PPAPI plugins) I think Flash, at least in Chrome, loads fonts from the browser. Which would mean it gets passed through OTS. I think all processes now share a common font cache on Chrome or at the very least they share code related to handling fonts.
Just looking at the fact that Flash still works with win32k lockdown enabled (meaning it can't use any GDI system calls) is probably enough evidence on its own (maybe). I don't know how other browsers handle font handling with Flash.
Just looking at the fact that Flash still works with win32k lockdown enabled (meaning it can't use any GDI system calls) is probably enough evidence on its own (maybe). I don't know how other browsers handle font handling with Flash.
[1] https://bugs.chromium.org/p/chromium/issues/detail?id=523278
[2] https://bugs.chromium.org/p/chromium/issues/detail?id=523278...
[3] https://bugs.chromium.org/p/chromium/issues/detail?id=523278...