That's incorrect. Web content needs additional privileges to paint web content into a canvas for exactly this reason.