On one hand, yes, new attack surface is new attack surface. But WASM has been in...

lich_king · 2026-03-11T18:56:26 1773255386

Without the bindings this talks about, so it really couldn't do nearly as much.

0x457 · 2026-03-12T00:13:39 1773274419

WASM has access to everything JS has via JS in the same sandbox that JS runs in.

JS didn't magically become more "secure". Multiple things happened:

- ActiveX and Flash got booted from browsers

- Browsers got much better sandboxes

Essentially limited what untrusted code can run and sandboxed that untrusted code. Before NaCl and PNaCl it was wild west in browsers.

The same sandbox runs WASM. It even goes through the same runtime in every browser. It's no different from compiling language of your choice to subset of JavaScript (see asm.js).