YouTube provides an API for this, described at https://developers.google.com/youtube/iframe_api_reference

There are many customizations that may be applied to the (automatically-embedded) video, including autoplay, muting (see this especially for muting: YouTube: How to present embed video with sound muted), inclusion/exclusion of YouTube branding, and on and on. Very nice (IMO) and it eliminates the iframe security problem.