WebAssembly security: what the sandbox actually gives you (and what it doesn't)

Every few months someone tells me WebAssembly is “sandboxed and memory-safe,” usually as a reason they don’t need to worry about the C library they just compiled to it. Half of that sentence is true. The other half gets people owned, and the gap between the two halves is where I want to spend this post. I’m going to make the argument with code you can run, not adjectives. Everything below is compiled with clang’s wasm32 target and run in Node, and I’ll give you the exact commands so you can reproduce it in a couple of minutes. What the sandbox actually guarantees The thing WebAssembly genuinely does well is isolation from the host. A module gets a single contiguous block of memory — “linear memory” — and that’s its entire world. It can’t name an address outside that block. It has no instruction that issues a raw syscall. Indirect calls don’t jump to an arbitrary address; they go through a table and are type-checked at the call site. Code and data live in separate address spaces, so a…