[flohofwoe]

If that actually works in a browser wasm environment then it's also possible from Javascript, which is a memory safe language (eg either the sandbox works or it doesn't, that also includes the external APIs).

[cygx]

Sure. Under that perspective, it's basically a new vector for XSS attacks.