Hm, sorry, I was under the impression the WebGL implementations were being done rather differently than they apparently are. I hadn't thought the calls were getting passed through directly due to security concerns.
Chrome, at least, appears to be a straight binding with extensive validation... That... kinda makes my nervous.
