Hacker News Reader

Isn't it the same with JavaScript?

Yes, and WebAssembly runs on top of the existing JavaScript VM engines.

I don't think it runs on the same V8 ( chrome ) that the one runs JS, I remember 2 engines running.

The wasm binary itself may be using a separate engine, but heavily sandboxed: it can only communicate with JS, and nothing else. The (newly added) attack surface is minimal when compared with Flash, Java, etc (each with its own APIs). Almost any flaw must be in the JS side, and that's already battle-proven for years.

ActiveX didn't even have a sandbox, so not even related.

The attack surface with classic NPAPI plugins (Flash, Java, etc) is practically unlimited. It was up to the likes of Flash and Java to secure themselves, not the browser. Various random plugins from other sources (eg, the QuakeLive and Unity plugins) may as well have cared about security _even less_ than the already abysmal track record of Flash and Java.

Did ActiveX even have a sandbox?

Nope! But you had to promise Verisign that you wouldn't build any malware.

I think it's more like a java addin. Which if properly sandboxed is a good thing.