I don't think this was the same vulnerability that you saw happening. I think many operations in shaders produce "unspecified" pixel values, which in practice o

I don't think this was the same vulnerability that you saw happening. I think many operations in shaders produce "unspecified" pixel values, which in practice often just manifests in getting pixel values from some previously freed buffer that is not yet overwritten. I believe webgl should remove these kind of side channels, but implementations could have bugs. Also GPU vendors should consider multi-user usage anyway and make these side channels impossible outside of webgl too. I doubt that they care and they would rather chase performance numbers.