Michael Jordon of Context IS reported that in the ANGLE
library used by WebGL the return value from GrowAtomTable()
was not checked for errors. If an attacker could cause requests that
exceeded the available memeory those would fail and potentially lead
to a buffer overrun as subsequent code wrote into the non-allocated space.
Ben Hawkes of the Google Security Team reported a WebGL test case that demonstrated an out of bounds write after an allocation failed.
Vulmon