I continue to wonder whether this can be legal at all. It's pretty clear they've been looking at the disassembled code, so it's not clean-room reverse-engineered.
I thought so too at first, but I'd expect non-x86 host systems running x86 guests to be vulnerable if that were the case. The advisory seems to indicate otherwise.
Firefox on macOS. It feels like the page is trying to do its own smooth scrolling in Javascript, on top of the browser's existing smooth scrolling or something.
I can confirm this is the behavior I'm seeing on Firefox. However, it's important to note that YouTube seems to force https if you're logged in, meaning logged-in Firefox users ALWAYS get the Flash player. I've resolved this for now by installing the YouTube ALL HTML5 add-on ( https://addons.mozilla.org/en-US/firefox/addon/youtube-all-h... ).