The security surface area will be either the png decoder or webgl, both are pretty well scrutinized but if I had to pick I would the png decoder is less likely to have a security issue compared to webgl.

Does't really matter because both png or webgl are available to any website at anytime.