[css-shaders] security - timing attacks

Don't CSS shaders end up exposing the same timing attacks for reading images
that WebGL used to before CORS support was added?

Basically, build a shader that takes more time depending on the pixels. Use
requestAnimationFrame to time how long compositing took, adjust until you
overflow a frame. You can now read pixels.