WebGL Considered Harmful

MSRC Blog / 2011 / 06 / webgl considered harmful WebGL Considered Harmful Security Research & Defense / By swiаt / June 16, 2011 The Khronos Group’s WebGL technology is a cross-platform, low-level 3D graphics API for the web. Recently, Context Information Security published two reports critical of the WebGL technology, WebGL – A New Dimension for Browser Exploitation and WebGL – More WebGL Security Flaws. One of the functions of MSRC Engineering is to analyze various technologies in order to understand how they can potentially affect Microsoft products and customers. As part of this charter, we recently took a look at WebGL. Our analysis has led us to conclude that Microsoft products supporting WebGL would have difficulty passing Microsoft’s Security Development Lifecycle requirements. Some key concerns include: • Browser support for WebGL directly exposes hardware functionality to the web in a way that we consider to be overly permissive The security of WebGL as a whole depends on

A screenshot of a Microsoft Security Research & Defense blog post titled “WebGL Considered Harmful.” The post argues that WebGL exposes hardware functionality too permissively and could create security problems, humorously matching the caption’s reference to Microsoft’s alarmist opposition to WebGL after Chrome enabled it by default. It is used as a reaction to exaggerated corporate fear, vintage technology FUD, or ironic security objections. EN: A screenshot of a Microsoft Security Research & Defense blog post titled “WebGL Considered Harmful.” The post argues that WebGL exposes hardware functionality too permissively and could create security problems, humorously matching the caption’s reference to Microsoft’s alarmist opposition to WebGL after Chrome enabled it by default. It is used as a reaction to exaggerated corporate fear, vintage technology FUD, or ironic security objections.

• @gentoomemes / 20381 2026-03-18