Sandboxing third-party code with WebAssembly linear memory and capability imports
Running untrusted third-party code close to users needs isolation without process overhead. WebAssembly linear memory plus capability-based imports gives a bounded sandbox with controlled host access.