Yup, according to the standard the procedure is: Let encrypted be false. Detect whether the frame is encrypted. If the frame is encrypted

Yup, according to the standard the procedure is: Let encrypted be false. Detect whether the frame is encrypted. If the frame is encrypted Run the steps above. Otherwise Continue. Decode the frame. Provide the frame for rendering. (From 4.2 of https://dvcs.w3.org/hg/html-media/raw-file/tip/encrypted-media/encrypted-media.html#waiting-for-a-key https://dvcs.w3.org/hg/html-media/raw-file/tip/encrypted-med... ) Which indicates that the frame is still going through the current playback method, and thus the results would be instantly dumpable if you had source access.