You must set the checkPolicyFile of the LoaderContext (the second (optional) argument of the load() method) to true in order to access the bitmapData of an image loaded from remote domain.
var loader:Loader = new Loader();
var context:LoaderContext = new LoaderContext(true);
loader.load(urlRequest, context)
Accessing BitmapData
When you load the image using the load() method of the Loader class, you can specify a context parameter, which is a LoaderContext object. If you set the checkPolicyFile property of the LoaderContext object to true, Flash Player checks for a cross-domain policy file on the server from which the image is loaded. If there is a cross-domain policy file, and the file permits the domain of the loading SWF file, the file is allowed to access data in the Bitmap object; otherwise, access is denied.
LoaderContext::checkPolicyFile
Set this flag to true when you are loading an image (JPEG, GIF, or PNG) from outside the calling SWF file's own domain, and you expect to need access to the content of that image from ActionScript. Examples of accessing image content include referencing the Loader.content property to obtain a Bitmap object, and calling the BitmapData.draw() method to obtain a copy of the loaded image's pixels. If you attempt one of these operations without having specified checkPolicyFile at loading time, you may get a SecurityError exception because the needed policy file has not been downloaded yet.
Loader::load()
If the loaded content is an image, its data cannot be accessed by a SWF file outside of the security sandbox, unless the domain of that SWF file was included in a cross-domain policy file at the origin domain of the image.
BitmapData::draw()
Note: The source object and (in the case of a Sprite or MovieClip object) all of its child objects must come from the same domain as the caller, or must be in a SWF file that is accessible to the caller by having called the Security.allowDomain() method. If these conditions are not met, the draw() method does not draw anything and throws a SecurityError exception. This restriction does not apply to AIR content in the application security sandbox.