Actually the description is apt -- the proposal is when a web page loads then a binary blob (that has OS-level hardware access) will be invoked. It would be as

Actually the description is apt -- the proposal is when a web page loads then a binary blob (that has OS-level hardware access) will be invoked. It would be as simple as including a highly-insecure JS file rather than installing a browser add-on/plug-in/extension/whatever. The security risks cause me imagine EME news that makes the recent Java 0-day news frighteningly tame.