quickly realized that some of the fingerprinting information could be useful for VM detection because vendor names were exposed. In this particular instance the string "VMWare" was contained within the WebGL information. After some more testing I also discovered that VirtualBox reported the same kind of information.
I believe there are patches that can close those holes, but I've always found the fact that such information is exposed by default and can thus make a VM obviously not look more like real hardware is puzzling. Ideally, a VM should be indistinguishable from real hardware, and in practice that ideal is difficult to achieve --- especially with timing-based detections --- but you'd think such obvious signs wouldn't appear.
Also, the amount of information that can be gathered via JS is disturbingly immense. To me, this is just further validation of the fact that JS needs to be off by default and whitelisted only for the (very few) sites that one truly trusts.