diff --git a/libwvdrmengine/cdm/include/wv_content_decryption_module.h b/libwvdrmengine/cdm/include/wv_content_decryption_module.h
index 182ec088..de877338 100644
--- a/libwvdrmengine/cdm/include/wv_content_decryption_module.h
+++ b/libwvdrmengine/cdm/include/wv_content_decryption_module.h
@@ -4,6 +4,7 @@
 #define CDM_BASE_WV_CONTENT_DECRYPTION_MODULE_H_
 
 #include <UniquePtr.h>
+#include <utils/RefBase.h>
 
 #include "lock.h"
 #include "timer.h"
@@ -15,7 +16,7 @@ class CdmClientPropertySet;
 class CdmEngine;
 class WvCdmEventListener;
 
-class WvContentDecryptionModule : public TimerHandler {
+class WvContentDecryptionModule : public android::RefBase, public TimerHandler {
  public:
   WvContentDecryptionModule();
   virtual ~WvContentDecryptionModule();
diff --git a/libwvdrmengine/include/WVCDMSingleton.h b/libwvdrmengine/include/WVCDMSingleton.h
index e82bfc59..ecb49dab 100644
--- a/libwvdrmengine/include/WVCDMSingleton.h
+++ b/libwvdrmengine/include/WVCDMSingleton.h
@@ -5,11 +5,13 @@
 #ifndef WV_CDM_SINGLETON_H_
 #define WV_CDM_SINGLETON_H_
 
+#include "utils/StrongPointer.h"
+
 #include "wv_content_decryption_module.h"
 
 namespace wvdrm {
 
-wvcdm::WvContentDecryptionModule* getCDM();
+android::sp<wvcdm::WvContentDecryptionModule> getCDM();
 
 } // namespace wvdrm
 
diff --git a/libwvdrmengine/mediacrypto/include/WVCryptoPlugin.h b/libwvdrmengine/mediacrypto/include/WVCryptoPlugin.h
index 25beecba..33942a6f 100644
--- a/libwvdrmengine/mediacrypto/include/WVCryptoPlugin.h
+++ b/libwvdrmengine/mediacrypto/include/WVCryptoPlugin.h
@@ -7,6 +7,7 @@
 
 #include <stdint.h>
 
+#include "utils/StrongPointer.h"
 #include "utils/Vector.h"
 
 #include "media/hardware/CryptoAPI.h"
@@ -19,7 +20,7 @@ namespace wvdrm {
 class WVCryptoPlugin : public android::CryptoPlugin {
  public:
   WVCryptoPlugin(const void* data, size_t size,
-                 wvcdm::WvContentDecryptionModule* cdm);
+                 const android::sp<wvcdm::WvContentDecryptionModule>& cdm);
   virtual ~WVCryptoPlugin() {}
 
   virtual bool requiresSecureDecoderComponent(const char* mime) const;
@@ -37,7 +38,7 @@ class WVCryptoPlugin : public android::CryptoPlugin {
  private:
   DISALLOW_EVIL_CONSTRUCTORS(WVCryptoPlugin);
 
-  wvcdm::WvContentDecryptionModule* const mCDM;
+  android::sp<wvcdm::WvContentDecryptionModule> const mCDM;
 
   bool mTestMode;
   wvcdm::CdmSessionId mSessionId;
diff --git a/libwvdrmengine/mediacrypto/src/WVCryptoPlugin.cpp b/libwvdrmengine/mediacrypto/src/WVCryptoPlugin.cpp
index df3bc3e8..c39f0551 100644
--- a/libwvdrmengine/mediacrypto/src/WVCryptoPlugin.cpp
+++ b/libwvdrmengine/mediacrypto/src/WVCryptoPlugin.cpp
@@ -29,7 +29,7 @@ using namespace std;
 using namespace wvcdm;
 
 WVCryptoPlugin::WVCryptoPlugin(const void* data, size_t size,
-                               WvContentDecryptionModule* cdm)
+                               const sp<WvContentDecryptionModule>& cdm)
   : mCDM(cdm),
     mTestMode(false),
     mSessionId(configureTestMode(data, size)) {}
diff --git a/libwvdrmengine/mediadrm/include/WVDrmPlugin.h b/libwvdrmengine/mediadrm/include/WVDrmPlugin.h
index a298d092..b880b442 100644
--- a/libwvdrmengine/mediadrm/include/WVDrmPlugin.h
+++ b/libwvdrmengine/mediadrm/include/WVDrmPlugin.h
@@ -17,6 +17,7 @@
 #include "utils/KeyedVector.h"
 #include "utils/List.h"
 #include "utils/String8.h"
+#include "utils/StrongPointer.h"
 #include "utils/Vector.h"
 #include "wv_cdm_event_listener.h"
 #include "wv_content_decryption_module.h"
@@ -41,7 +42,7 @@ const OEMCrypto_Algorithm kInvalidCrytpoAlgorithm =
 class WVDrmPlugin : public android::DrmPlugin,
                     public wvcdm::WvCdmEventListener {
  public:
-  WVDrmPlugin(WvContentDecryptionModule* cdm,
+  WVDrmPlugin(const android::sp<wvcdm::WvContentDecryptionModule>& cdm,
               WVGenericCryptoInterface* crypto);
 
   virtual ~WVDrmPlugin();
@@ -248,7 +249,7 @@ class WVDrmPlugin : public android::DrmPlugin,
     std::string mAppId;
   } mPropertySet;
 
-  WvContentDecryptionModule* mCDM;
+  android::sp<wvcdm::WvContentDecryptionModule> const mCDM;
   WVGenericCryptoInterface* mCrypto;
   std::string mOrigin;
   map<CdmSessionId, CryptoSession> mCryptoSessions;
diff --git a/libwvdrmengine/mediadrm/src/WVDrmPlugin.cpp b/libwvdrmengine/mediadrm/src/WVDrmPlugin.cpp
index 21f5d0c4..4dac6fed 100644
--- a/libwvdrmengine/mediadrm/src/WVDrmPlugin.cpp
+++ b/libwvdrmengine/mediadrm/src/WVDrmPlugin.cpp
@@ -73,7 +73,7 @@ DrmPlugin::KeyStatusType ConvertFromCdmKeyStatus(CdmKeyStatus keyStatus) {
 
 }  // namespace
 
-WVDrmPlugin::WVDrmPlugin(WvContentDecryptionModule* cdm,
+WVDrmPlugin::WVDrmPlugin(const sp<WvContentDecryptionModule>& cdm,
                          WVGenericCryptoInterface* crypto)
   : mCDM(cdm), mCrypto(crypto), mOrigin(), mCryptoSessions() {}
 
diff --git a/libwvdrmengine/src/WVCDMSingleton.cpp b/libwvdrmengine/src/WVCDMSingleton.cpp
index c89aacae..c6d21977 100644
--- a/libwvdrmengine/src/WVCDMSingleton.cpp
+++ b/libwvdrmengine/src/WVCDMSingleton.cpp
@@ -9,21 +9,30 @@
 #include "WVCDMSingleton.h"
 
 #include "utils/Mutex.h"
+#include "utils/RefBase.h"
 
 namespace wvdrm {
 
 using wvcdm::WvContentDecryptionModule;
 using android::Mutex;
+using android::sp;
+using android::wp;
 
 Mutex cdmLock;
-WvContentDecryptionModule* cdm = NULL;
+// The strong pointers that keep this object alive live in the plugin objects.
+// If all the plugins are deleted, the CDM will be deleted, and subsequent
+// invocations of this code will construct a new CDM.
+wp<WvContentDecryptionModule> sCdm;
 
-WvContentDecryptionModule* getCDM() {
-  Mutex::Autolock lock(cdmLock);
+sp<WvContentDecryptionModule> getCDM() {
+  Mutex::Autolock lock(cdmLock);  // This function is a critical section.
+
+  sp<WvContentDecryptionModule> cdm = sCdm.promote();
 
   if (cdm == NULL) {
     ALOGD("Instantiating CDM.");
     cdm = new WvContentDecryptionModule();
+    sCdm = cdm;
   }
 
   return cdm;