Apologies, I didn't realize this was just about AAA games, I saw Quake 3 in there... ;) I don't think a major overhaul is necessary to make WebGL secure. There

Apologies, I didn't realize this was just about AAA games, I saw Quake 3 in there... ;) I don't think a major overhaul is necessary to make WebGL secure. There is really just one remaining issue, which is DOS attacks from slow shaders. This is not an issue on recent Windows releases which can almost seamlessly restart the GPU. Aside from that, yes, there will be GPU driver exploits. There are also browser exploits and network stack exploits - we don't stop making browsers and network-connected applications though. WebGL-ready browsers have very good capabilities to work around such exploits, either by simply blacklisting known bad drivers, or adding things like bounds checks to shaders etc. (which is currently done). Otherwise, exploits will happen and browsers will prevent them, just like browsers already do for non-WebGL content.