IIRC EME is sandboxed, so you can't really expect any vulnerabilities in it to be exploitable. This is equivalent to complaining that sites you can visit can ru

IIRC EME is sandboxed, so you can't really expect any vulnerabilities in it to be exploitable. This is equivalent to complaining that sites you can visit can run arbitrary javascript. Security researchers neednt investigate the DRM itself, they can instead verify the sandbox.