It's irrelevant whether the CDM is part of the browser, part of the OS or an installed plugin like Java. The browser must invoke the closed source, vendor prov

It's irrelevant whether the CDM is part of the browser, part of the OS or an installed plugin like Java. The browser must invoke the closed source, vendor provided CDM by pass a binary stream from the server. Certainly, it's no worse than what we currently have, but current plugins have, shall we say, a rocky security history wouldn't you say? (>_> java) Worse, every content provider is going to have their home written CDM, because they certainly aren't going to share. Once a CDM is compromised thats it, it's useless. It's going to be a nightmare of install-all-the-plugins. Most likely major browsers will bundle the most popular one to reduce the burden on the user.