Popping an alert from a sandboxed WebAssembly module

Would you believe me if I told you this HTML page could show an alert('hi from WASM') , when loaded? < script > WebAssembly . instantiateStreaming ( fetch ( "plugin.wasm" ), {}); </ script > More generally, if plugin.wasm is attacker-controlled, this could execute arbitrary JavaScript, despite the empty object as imports! Doesn&rsquo;t this feel counter-intuitive, given the isolation properties of…