WebGL as a proxy API is implemented by the browser, yes, but the thing it's proxying (the graphics driver) is well outside the sandbox and is arguably too compl

WebGL as a proxy API is implemented by the browser, yes, but the thing it's proxying (the graphics driver) is well outside the sandbox and is arguably too complex to be secured by parameter validation and the like. If the driver has an exploitable bug in its shader compiler, for example, the WebGL layer is unlikely to be able to guard against it.