I realized there's a problem with the very strict interpretation of allowDomain we have right now: it prevents loading of images and videos, too. We need to still allow those, as not doing so has the potential to break way too much content. The thing to do is probably to start loading and do the allowDomain check after the header has been parsed. If it's a SWF and the check fails, stop loading and discard the results. If it's an image, do the load, but prevent it from being passed into the player's iframe. That makes the inner sandbox more important than it was before, but I don't see a way around it. Example of content broken by this: http://ichizengogo.blog.fc2.com/blog-entry-43.html (the image widget on the left)

allowDomain doesn't need to block M3 because it only breaks some ads.

Till is working on cross-domain image loading.

Will be fixed by https://github.com/mozilla/shumway/pull/2320.