I think this can be solved via UX. When the browser wants WebGL, notification privs, etc: 1. Pend the request 2. Notify the user "This site wants access to the

I think this can be solved via UX. When the browser wants WebGL, notification privs, etc: 1. Pend the request 2. Notify the user "This site wants access to the WebGL graphics API to display complex graphics. This is disabled by default to prevent browser fingerprinting. If the site fails to work properly, click the lock icon and allow it." 3. Deny access until the user explicitly enables it on a temporary or permanent basis