Being a Pepper plugin doesn't help at all. It's still a black box. It still has full access to your machine. It can not be sandboxed because it's up to the CDM

Being a Pepper plugin doesn't help at all. It's still a black box. It still has full access to your machine. It can not be sandboxed because it's up to the CDM to decide how to validate and how deep to connect to the machine. The CDM will want to control the bits from the time they get delivered to the CDM from the browser, all the way to the monitor with whatever tech the CDM author feels like employing. Chrome can not validate the code nor the inputs to the code. It's a giant security hole. For all you know some CDM will just implement the blu-ray standard, Java and all. Yep, unsecured code execution.