Honestly I'm not that sure, and that was a shitty way for me to word it about Unity. The big thing with PPAPI is that it can be much more sandboxed than NPAPI e

Honestly I'm not that sure, and that was a shitty way for me to word it about Unity. The big thing with PPAPI is that it can be much more sandboxed than NPAPI ever could, which means it already has a big step up in security, but obviously anything whose purpose is to circumvent the restrictions put in place for the browser is going to be inherently less secure than just running a website. In the end PPAPI could let you run code from a webpage as "root" on your computer, and there is nothing Chrome or anyone else can do to stop that. That being said, I think Unity is going in the right direction trying to get away from plugins altogether. They are trying (successfully IMO) to compile to "true" web technologies and let the game be exported as HTML5 and javascript which is the right choice.