Security fixes are provided for the latest published minor version.

Do not open a public issue for a suspected vulnerability. Email security@obvia.studio with reproduction steps, affected versions and expected impact. You should receive an acknowledgement within 72 hours.

WGX can submit caller-provided WGSL, GLSL and media data to browser GPU APIs. Applications should treat shader source, cross-origin media, backend capabilities and extension availability as untrusted input and apply their own content-security and origin policies.