The CDM and the server runs some sort of secure key exchange with the browser doing the actual network traffic. The browser is eavesdropping on the communication but that's what Diffie-Hellman, STS etc are solving. Then the browser gets the encrypted stream, hands it to the CDM which has some ties to the OS to be able to draw on the screen. Only tie to the OS is required, no files, no network. The browser can handle those.