I never said that shaders are arbitrary code or that they're executed in the kernel. WebGL in general opens up a huge attack surface, however, much of which is in the kernel. As soon as WebGL hit Webkit, I started testing it for two reasons: 1) I do 3d art, and 2) I work in security. I understand the systems involved quite well, and I'm still very concerned about it.