CSRF: can the JSON data returned by a POST request be stolen?

Question

Can the JSON data, returned by a POST request be stolen by a cross-site request forgery attack?

Answer 1

It cannot be done using JS, but I'm not sure about Flash's cross-domain request.

In JS POST request can be made via forms and XMLHTTPRequest. You can't see result of a cross-domain form, so that's safe. XHR forbids cross-domain requests, so that's safe too.

Browsers do allow cross-domain inclusion of scripts via <script> element, but that is using GET only.