Edit: Also, "google chrome incognito mode is apparently not designed to protect you against other users on the same computer".. what? Isn't that the only thing it can and should protect against? It's not like it can protect against non-local users (i.e. HTTP network interceptions)
You don't need webgl for this kind of infoleak either, regular good old 2d canvas also supports allocating memory. It also supports reading the current state of all of the pixels in the buffer through Javascript, so if you have an exploit that gets you an uninitialized canvas you can easily send whatever memory contents you got back to your server for later analysis.
If the DOM element you draw has the same origin as your canvas it seems like (from my reading of the spec) you should be allowed to do what you describe.
WebGL being enabled by default is insanity in my opinion.
Imagine being able to open an incognito terminal to type commands that won't get saved to history or pollute what you already have.
unset $HISTFILEPeople considered it a profile switching for dummies, now no one remembers that browser can have multiple profiles.
As I understand it, this is not how frame buffers work. All they contain is the rastered data to drive the a given frame.