We&#x27;ve already had these kinds of issues with webgl. Here&#x27;s one that I found through some googling: <a href="http:&#x2F;&#x2F;www.cvedetails.com&#x2F;cve&#x2F;CVE-2014-3173&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.cvedetails.com&#x2F;cve&#x2F;CVE-2014-3173&#x2F;</a><p>You don&#x27;t need webgl for this kind of infoleak either, regular good old 2d canvas also supports allocating memory. It also supports reading the current state of all of the pixels in the buffer through Javascript, so if you have an exploit that gets you an uninitialized canvas you can easily send whatever memory contents you got back to your server for later analysis.