While NaCl poses security concerns, they have invested a lot of effort to make the sandbox secure. Their first two papers deal with this quite a bit [1,2] and the new paper seems to expand on this more, but I haven't read it yet [3]. ActiveX doesn't even compare -- it's just running native code.
Portable NaCl (PNaCl) looked very promising (targeting LLVM (bytecode) and then re-targeting your native architecture) but I haven't heard anything about it lately.
I was less referring to the security issues, as I'm familiar with Google's efforts on those fronts, and more referring the lack of cross browser support. ActiveX sucked for a number of reasons, but one reason in particular was because it forced people to use IE even after IE 6 became the most inferior browser on the market by a long shot in terms of both security and performance. If NaCl becomes popular enough, either other browsers will be forced to add it or there will be similar lock-in issues. If other browsers are forced to add it, will every single one of them have the same security, performance and compliance with the standard as Google Chrome does?
I don't see lock-in issues as a concern. It's an open spec, if it becomes popular enough then even if other browsers don't want to support it developers can make plugins for those browsers (some of the papers even mention this, I believe). In any case, if websites require you to use NaCl it is only stupid unless they are doing something that otherwise wouldn't be feasible e.g. running a performance hungry emulator. It's clear to me that Google has no intentions to leverage this for lock-in.
If other browsers are forced to add NaCl support: of course I doubt they will have the same security, performance and compliance that Chrome does -- but who are we kidding, it's highly unlikely that all browsers will ever be equal in those ways.
