Comment by cleeus

Remember that WebGL is also a security nightmare. Shaders are fed to the GPU driver. The driver contains a compiler and compiles the shaders into the GPU specific ISA. The GPU that runs that code is a PCIe device with full DMA access. What could possibly go wrong?

(I'm aware that at least Chrome does some syntactic checks on the shader syntax)