Adobe Flash TextField.tabIndex Setter Use-After-Free There is a use-after-free in the TextField.tabIndex setter. If the integer parameter is an object with valueOf defined, then it can free the TextField’s parent, leading to a use-after-free. Leave a ReplyYou must be logged in to post a comment. Filed under: exploit - @ December 18, 2015 9:47 pm