The latest update to the File API removed the "Origin of Blob URIs" section that MSE's "MediaSource Object URL" section was referencing. This means that the MediaSource object no longer has a clear definition for its origin.
The following is the text that was removed from the File API spec.
"The origin of a Blob URI must be the origin of the script that called URL.createObjectURL. Blob URIs must only be valid within this origin."
We need similar text in the MSE spec or a new reference to a section in the File API spec that clarifies the origin for Blob URIs.
The text was removed based on this conversation:
I'm not sure we should consider media source object URLs same-origin so I propose that we start conservatively until we can prove that is safe.
To do this I propose that we import the definition we've been using from the old File API draft.
Proposed text: "The origin of the MediaSource object URL is the effective script origin of document that called URL.createObjectURL."
[effective script origin] = http://www.w3.org/TR/html5/browsers.html#effective-script-origin