The old 3d driver model relied on trust. If you ran a 3d program, you have probably installed it and you trust it. 3d program writers spend a lot of time fixi

The old 3d driver model relied on trust. If you ran a 3d program, you have probably installed it and you trust it. 3d program writers spend a lot of time fixing bugs to try and make sure their program does not crash users machines. I've been writing 3d code for over 15 years now, and have yet seen a machine that I don't accidentally crash whilst writing code against it. This has all now changed. WebGL allows anyone to access a much greater section of the 3d hardware than before. The 3d driver writers have not accounted for this in writing their software. Good for 3d drivers, because now there will be much wider testing with more easily repeatable bug reports. Since it is such a nice attack vector, we should also see more 3rd party testing. Also, this can only increase the amount of people using 3d - so driver writers will definitely need to spend more work on making their code safer against evil input. I don't think it is as bad with WebGL compared to what you can do with opengl. There's less pointer passing of shared memory regions. Also, all the browsers have black lists for 3d hardware/OS versions already. So if a particular card/driver combination is found to be buggy, they can black list it easily for all users. tl;dr it definitely is unsafe, but the sky isn't necessarily falling... yet.