In my understanding, they are using only mp4 files, and control the mp4 writers, so they should be fine with most devices' Android MediaPlayer. Though yeah, I'

In my understanding, they are using only mp4 files, and control the mp4 writers, so they should be fine with most devices' Android MediaPlayer. Though yeah, I'd personally rather go to ExoPlayer to have a managed, maintained solution that already contains most fucked up hardware workarounds you might need. Sure it's not cross-platform, but just define a high-level player api, use iOS' native player, ExoPlayer on Android, vlc on other platforms, and you're good to go. As for "sticking untrusted data into platform media api's", well the power consumption of reading a video with CPU is absurdly high. You'd be going from 6 hours view time on a standard smartphone to 2 I'd say? You could decide that you value security /that much/. But then if you do, the very first thing to do is to run the player in a dedicated isolated process. I doubt WhatsApp is doing software video decoding, but if they are, it is all the more ridiculous.