WebGPU is not significantly more "bare metal" than WebGL is. There are still going to be several layers of abstraction between user code and the GPU in all case

WebGPU is not significantly more "bare metal" than WebGL is. There are still going to be several layers of abstraction between user code and the GPU in all cases. No operating system implements WebGPU or WGSL directly so there's always a translation and verification layer in the browser, and then there's the OS API layer, and then the driver layer (and probably multiple layers inside each of those layers). In fact, on operating systems that implement OpenGL, WebGL is actually closer to the OS/driver interface than WebGPU is. WebGL has been around for a long time and the feared exploits never materialized. It's been no worse than other parts of the browser and better than many.