[10000truths]

I don't see how Spectre or hardware address spaces are relevant here. WASM code cannot access memory that is not explicitly provided to the sandbox, by design. Each load/store opcode is bounds-checked by the WASM engine to ensure that. Wouldn't be much of a sandbox, otherwise.

[rockwotj]

You can still have Spectre attacks, check out this blot post

https://blog.cloudflare.com/mitigating-spectre-and-other-sec...