WebGL Flaw

[kiwi]

http://www.contextis.co.uk/resources/blog/webgl/

can you add an option to disable WebGL or to block cross-domain request?

Thanks!

[Giorgio Maone]

It's not trivial, since they're seen as normal cross-site image loads.

However, the attack requires JavaScript enabled on the attacker's site, so NoScript already protects against it.

[therube]

WebGL & Security

> The blacklist can be deployed daily without a full software update so we can respond rapidly to any issues.

Wonder that might entail as far as the numbers, upkeep, ...