What Is the Widevine CDM (Content Decryption Module)?

Open chrome://components in Chrome and scroll down. Somewhere in the list you will find an entry called Widevine Content Decryption Module, with a version number and a “Check for update” button. Most people never look at it, but without it, Netflix, Disney+, Prime Video, Spotify’s web player and thousands of paid course sites would refuse to play.

This article explains what a content decryption module is, how the Widevine CDM fits inside your browser, why it is kept separate from the rest of the browser, and how to fix the errors that appear when it goes missing or out of date.

What a CDM is

A Content Decryption Module (CDM) is a small, closed piece of software that handles the secret part of DRM playback: turning encrypted video into something the screen can show, without letting the website, the browser or you see the decryption keys.

Browsers are open by design. Anyone can read a web page’s JavaScript and inspect the network traffic. That openness is a problem for DRM, because a key visible to JavaScript is a key anyone can copy. The solution the web settled on is to split playback into two parts:

• The open part: the website’s player, written in JavaScript, fetches the manifest and segments and handles the user interface.
• The closed part: the CDM, supplied by the DRM vendor, holds the keys and decrypts the media.

The two talk through a standard browser API called Encrypted Media Extensions (EME). EME lets the player pass messages to the CDM and back, but it never exposes the keys themselves.

The Widevine CDM is Google’s implementation. Other CDMs include PlayReady inside Edge and Windows, FairPlay inside Safari, and the simple ClearKey CDM that every browser includes for testing.

What the Widevine CDM actually does

When you press play on a protected video in Chrome, Firefox or Edge using Widevine, the CDM handles these jobs:

1. Generates the licence request. The player gives the CDM the initialisation data from the video (a pssh box containing the key IDs). The CDM builds a signed request that proves which CDM and device it is.
2. Processes the licence. The licence server’s response goes back into the CDM, which verifies it and extracts the content keys. Keys stay inside the CDM.
3. Decrypts media samples. As the player feeds encrypted segments to the browser’s media pipeline, the CDM decrypts each sample.
4. Enforces policy. The licence may say “valid for 24 hours” or “HD only with output protection”. The CDM enforces those rules and tells the player when keys expire.
5. Manages sessions. For offline or persistent playback on supported platforms, the CDM stores and later reloads licences.

On desktop browsers, Widevine runs at the software security level, L3. Decryption happens in a sandboxed, heavily obfuscated process. On Android, ChromeOS and many TVs, the platform version of Widevine can use hardware protection (L1). The differences are explained in Widevine L1 vs L2 vs L3.

Why the CDM is a separate download

In Chrome, the Widevine CDM is delivered through Chrome’s component updater rather than being part of the main browser build. In Firefox, it is downloaded as a “Gecko Media Plugin” after installation. There are good reasons for this separation:

• Faster security updates. Google can revoke an old CDM version and push a new one without a full browser release. Streaming services often stop issuing licences to CDM versions that are known to be weak.
• Licensing. Widevine is proprietary. Keeping it separate lets open-source browsers such as Chromium and Firefox ship their own code under open licences, and fetch the closed module only where it is allowed.
• Sandboxing. The CDM runs in a restricted process with limited access to the file system and network, which reduces what a bug in it could do.

The downside is that the CDM can fall out of date or fail to download, which leads to the common error messages below.

How to check and update the Widevine CDM

Chrome and Chromium browsers

1. Type chrome://components in the address bar and press Enter.
2. Find Widevine Content Decryption Module.
3. Click Check for update. The status should change to “Component updated” or “Up-to-date”.
4. Restart Chrome completely, including background processes.

Edge (edge://components), Brave (brave://components), Opera and Vivaldi have the same page. In Brave you may also need to allow Widevine in brave://settings/extensions, because Brave asks for permission before installing it.

Firefox

1. Open Settings and search for “DRM”.
2. Tick Play DRM-controlled content.
3. Open the menu, go to Add-ons and themes, then Plugins. You should see “Widevine Content Decryption Module provided by Google Inc.” with a version number.
4. If it is missing, use the gear icon and Check for Updates, then restart Firefox.

Quick test

Run our DRM support checker. If Widevine shows “Yes” for the software robustness levels, the CDM is installed and working.

Common Widevine CDM errors and fixes

“Widevine Content Decryption Module needs to be updated” or “is not available”. Update through the components page as above. If the update fails, a firewall, proxy or corporate policy may be blocking Google’s update servers. On managed work computers, IT may have disabled component updates on purpose.

Netflix error M7701-1003, M7111-1331 or similar in the browser. These usually mean the CDM is missing, disabled or blocked. Check the components page, turn off extensions temporarily, and avoid private or incognito windows while testing, because some browsers restrict DRM storage there.

Protected video plays audio but shows a black screen. Often a graphics driver or hardware acceleration problem. Update the GPU driver, then toggle Use graphics acceleration when available in Chrome’s system settings and restart.

Works on one browser but not another on the same PC. Each browser has its own CDM copy. Update the failing browser’s CDM, and in Firefox make sure DRM is enabled.

Linux on ARM or unusual distributions. Google does not ship the Widevine CDM for every platform. Some Linux ARM devices cannot play Widevine content in the browser at all, although distributions sometimes provide workarounds using official ChromeOS components.

The component page says the CDM is up to date, but a service still fails. Some services block specific browsers, virtual machines or remote desktop sessions. Try on a normal desktop session, and check the service’s help page for supported browsers.

Why screen recording shows a black box

People often notice that screen recorders, screenshot tools and screen sharing in meeting apps show a black rectangle where a protected video should be. That is the CDM and the operating system working together. When protected content is playing, the browser marks those video frames as protected and the system excludes them from capture. It is intended behaviour, not a bug, and it is one of the ways DRM discourages casual copying.

Is the Widevine CDM a privacy risk?

The CDM is closed-source, which understandably makes some people uneasy. A few facts help put it in context:

• It runs in a sandbox with limited permissions, isolated from the rest of the browser.
• It only activates when a website uses EME to request com.widevine.alpha. Normal browsing does not use it.
• Browsers give each site a different, resettable identifier for the CDM, so it cannot be used as a cross-site tracking ID in the way a cookie can. Clearing site data resets it.
• Firefox lets you turn DRM off entirely if you prefer not to use it.

If you never watch paid streaming in the browser, disabling DRM costs you nothing. If you do, the CDM is the price of entry.

What developers should know

If you build a video player, the CDM is a black box you interact with through EME. A few practical notes:

• Check availability first. Call navigator.requestMediaKeySystemAccess('com.widevine.alpha', config) with the codecs and robustness levels you need. If it fails, show a helpful message rather than a spinner.
• Ask for robustness explicitly. If you omit the robustness field, Chrome logs a warning and you lose control over which security level is used.
• Handle key status changes. Listen for keystatuseschange events, which tell you when a key has expired or output protection is not available.
• Serve over HTTPS. EME is only available in secure contexts.
• Test multiple CDM versions. Services sometimes stop serving old CDM versions; make sure your licence server’s minimum-version policy matches your audience.

The EME guide goes through each of these calls with examples, and what is Widevine DRM explains the full licence flow the CDM takes part in.

In one sentence

The CDM is the locked room inside your browser where protected video gets unlocked, and nobody else, not even the page, gets the key.

Summary

The Widevine CDM is the closed component inside Chrome, Firefox, Edge and other browsers that decrypts protected video without exposing keys to the web page. It is updated separately from the browser, enforces licence rules, and is the reason protected video shows as a black box in screen recordings. When streaming sites fail in the browser, checking and updating the CDM is the first fix to try.