> Doesn't WebGL essentially use root access to your gpu?

Only in badly-designed, non-conformant user agents. :)

The WebGL security issues have, for at least a year, been FUD. The spec is essentially fixed, drivers have become a whole lot better, and browsers have become a whole lot stricter in their validation code. WebGL is not OpenGL nor OpenGL ES.

Examples: while the OpenGL ES spec is silent on buffer overflows, WebGL mandates user agents to signal errors; while OpenGL ES doesn't specify the state of freshly allocated textures, WebGL requires them to be blanked out; WebGL textures can never be from non-origin-clean canvases.