A related critical issue is that OpenGL is a huge and extremely complex API with huge and extremely complex drivers, and has never been accessed before by untrusted code.
Hence, I feel it's extremely likely that all current OpenGL drivers are broken and exploitable via WebGL: it would probably be strongly advisable to not enable it by default on Internet sites.