TEmbeddedWB/Webbrowser set local zone security to accept loading local SWF file does not work but do work in 'real' browser

Question

Story: I developing a game that I want to deploy to many platforms using a webview/embedded browser for the target os. Write once, deploy many times ;-)

The game itself is developed with use of HTML5/CSS3 and javascript and also with a little bit flash for platforms that supports flash like Windows and MacOsX. The flash file is used for audio only, because the HTML5 audio tag can operate different platforms and does not have many features compared to flash. On mobile platforms it will switch back to the audio tag.

Anyway, I have written a 'compiler' that can compact my code and changes/map paths of resources/assets to the local filesystem. This is to be able to deploy games or other apps created with HTML/etc without the need to access the internet and to combine it into a single package. All javascript is minified and 'embedded' in the HTML file including CSS and some small images. But this cannot be done with Flash/SWF files (i think?).

This is my question: I have tested the local version of the game in a 'real' desktop browser like Firefox, Safari, Opera ,Chrome and Internet Explorer 9. Flash is working in all browsers except Chrome.

BUT: when i load it into the embedded version of IE9 (Delphi executable with TEmbeddedWB), it won't load the flash file. I found some code to set the zone mapping security but doesn't seems to work:

  var 
   sUrl : string;
   sw : WideString;
.....
.....
  sUrl:='file:///C:\mygame\mygame.html';
  sw:=WideString( sUrl );
  if( embeddedWB.SecurityManager.SetZoneMapping(URLZONE_LOCAL_MACHINE, PWideChar( @sw ),SZM_CREATE) = S_OK ) then
   showMessage( 'OK' )
  else showMessage( 'NOT SET' );  
  embeddedWB.Go( sUrl );

.....

A messagebox with 'OK' shows up and loads the document but no flash (no sound).

Question: What is wrong, why is it not working, anybody any idea how to solve this?

For your information:

• I have tested that IE9 is running
• The flash file uses Security.allowDomain( "*" );
• I have created a security policy xml file for the SWF (crossdomain.xml)

crossdomain.xml:

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
  <site-control permitted-cross-domain-policies="all" />
  <allow-access-from domain="*" />
  <allow-http-request-headers-from domain="*" headers="*"/>
</cross-domain-policy>    

Thank you for any reply. If you have any questions, please let me know.

Answer 1

I'm told that earlier this year, Chrome was changed to prohibit the loading of local flash files. (I don't understand why only local files would be a security risk, but web-based ones not...)

See the comments on my question related to this topic here: Detect Chrome as browser associated with html files in Windows. One of them mentions that local flash files can be problematic on IE too.

We decided to never use local flash files in our applications.xc

Edit: here's a link to the bug report on Chrome: http://code.google.com/p/chromium/issues/detail?id=140755. It doesn't sound like a pretty situation.

Update: While trying to play an MP4 in Techsmith's Camtasia's player in Chrome, I got the message below. This is a confirmation of the behavior I described above.