I know that there is already a question related to viruses in videos, but the implication in the other question is that videos in question have been downloaded and played by media software on the target computer. The answer for that question is that yes, viruses can be embedded in videos for this purpose.
But what I am instead referring to are videos viewed through browsers (which are technically media software on target computers, if you want to split hairs). Now obviously we are talking about two distinct types of video: flash and HTML5 (MP4, WebM, Ogg). Are either/both of these vulnerable to this sort of exploitation, and if so, how would it operate? Presumably the browsers are somewhat sandboxed, so we would be talking about the browser specifically being targeted, rather than the computer on which the browser is on?