WebGL mandates that the user agent check indices: http://www.khronos.org/registry/webgl/specs/latest/#ATTRIBS_AND_RANGE_CHECKING http://www.khronos.org/registry

WebGL mandates that the user agent check indices: http://www.khronos.org/registry/webgl/specs/latest/#ATTRIBS_AND_RANGE_CHECKING http://www.khronos.org/registry/webgl/specs/latest/#ATTRIBS_... As I alluded above, the current WebGL spec is actually fairly well-designed with respect to trying to crash display drivers. The word "undefined" actually only appears once in the current spec, in a bit about canvas drawing buffers being preserved across frames. And, in fact, in that case it mandates implementations to clear the buffer before any WebGL call can read the contents to prevent leakage. Most of the claims of WebGL security issues are either to old versions of the spec (which leaked data to shaders and led to things like timing attacks) or are currently a bit on the hyperbolic side.