Day 87 of 100DaysOfSpec, the embed element

I am reading and taking notes on the HTML specifications for 100 days as part of #The100DayProject. Read the initial intent/backstory. I am a Microsoft employee but all opinions, comments, etc on this site are my own. I do not speak on behalf of my employer, and thus no comments should be taken as representative of Microsoft's official opinion of the spec. Subsections not listed below were read without comment.

Currently reading in 4.7.3 The embed element

“The embed element provides an integration point for an external (typically non-HTML) application or interactive content.”

• Considered flow, phrasing, embedded, interactive, and palpable content. ALL the categories! Well, almost.
• Can’t contain descendants.
• No end tag.
• Can have these ARIA roles: application, document, img, or presentation.

Attributes, besides the globals:

• src

• type: a valid MIME type. I can’t seem to find the list they reference, but here’s a mega list!

• width

• height

• “Any other attribute that has no namespace” More on this later.

• Lots of requirements on the embed to be considered “potentially active”. Of note, the element is not a descendent of a media element, nor of an object element that is not showing its fallback content.

• No fallback content on the embed element.

• “If the user agent can’t find a suitable plugin when attempting to find and instantiate one for the algorithm above, then the user agent must use a default plugin. This default could be as simple as saying ‘Unsupported Format’.”

• That plugin has to be unloaded when the embed element can no longer be considered potentially active.

• If said plugin can’t be secured and “the sandboxed plugin’s browsing context flag is set on the embed element’s Document’s active sandboxing flag set”, the user agent should not load the plugin, and should show the embed as a disabled plugin message (you’ve seen this for Flash, surely).

• “Plugins that cannot be secured are disabled in sandboxed browsing contexts because they might not honor the restrictions imposed by the sandbox”.

• “Any namespace-less attribute other than name, align, hspace, and vspace may be specified on the embed element, so long as its name is XML-compatible and contains no uppercase ASCII letters.” Those exceptions are for legacy embed stuff.