http://www.chromium.org/Home/chromium-security/brag-sheet Presumably flash is sandboxed within chrome, so it isn't susceptible to the same attack vectors as unsandboxed plugins.

This presumably alleviates a lot of the security concerns for that plugin, since it now has the same protection to exploitation as the rest of chrome, and security vulnerabilities might be able to be patched through chrome's auto-update(?)

QuickTime is much more closely tied with the OS than flash is and probably nigh impossible to sandbox and ensure it's on the latest version

I think that's a valid point, but I'd like to introduce a few reasons why google may see them differently. Adobe has developed a sandbox for flash, adobe has been working with google to leverage the chrome sandbox (at least in windows), and adobe has given google access to early builds and authorization to distribute them and keep them up to date, so that google can know that if they're running flash it's not an out of date version. In several cases google has been shipping flash security updates to all chrome users before adobe actually pushed to their installed base (which only checks for updates once a week and needs the user to approve them). In comparison, quicktime security features and update practices are considerably worse off.

I think the word that java is also disabled in the nightlies in the same fashion should suggest that this isn't some partisan x264 or open web fight. It's security.

Adobe did the work to enable sandboxing Flash. Apple hasn't done the work (yet?) to enable sandboxing Quicktime. That's all it is.

? Not a fan of Flash, but video-playback is a very, very small part of the Flash platform (and even then it's often producer-friendly in the form of supporting extensive DRM for the illusion of content control), while it is virtually all of QuickTime. QuickTime is completely obsolete. Flash is just mostly obsolete.