Just in components that claim to provide security boundaries but then do OpenGL passthrough without precautions. Web browsers handle this this properly in WebGL. VirtualBox is at fault here.

Your linked article is about just running two native desktop apps side by side under the same user account, there isn't any supposed security boundary between them so it's a different case.