← Back to release summary

Remove EME from Unsecure Contexts

Category
Security
Type
New or changed feature
Status
Removed (Chrome 58)
Intent stage
None

Summary

Per https://w3c.github.io/webappsec-secure-contexts/, we are deprecating and then removing EME from insecure contexts. EME is a powerful feature that exposes DRM implementations that involve access to persistent unique identifiers, are not open source, and/or run unsandboxed or with privileged access. The risks are increased when exposed via insecure HTTP, because they could be attacked by anyone on the channel. This was deprecated in Chrome 44.

Standards & signals

Docs: Part of the larger effort to remove powerful features on insecure origins: https://chromium.org/Home/chromium-security/deprecating-powerful-features-on-insecure-origins https://developer.mozilla.org/en-US/docs/Web/API/HTMLMediaElement/setMediaKeys

View on chromestatus.com