Service Workers serving Flash content

Has any thought been given to SWs serving up Flash files from other domains? Flash’s origin restrictions are opposite from the SOP. If evil.com loads a flash file from good.com, that Flash file can make HTTP requests with the browser's cookies back to good.com and read the response. There doesn’t seem to be any way to prevent this from good.com so long as it is serving the Flash file. With SWs, it seems like evil.com could register a SW that serves a non-existent malicious Flash file, appearing to come from good.com. From there, the Flash file can make requests to good.com and can read CSRF tokens or other sensitive information from the responses.  

--  
Ben Toews