The security issues with things like Flash and Java is that they increase the attack surface drastically. Furthermore, they come from different companies from t

The security issues with things like Flash and Java is that they increase the attack surface drastically. Furthermore, they come from different companies from the web browser, and often with their own updating mechanisms. Even if your browser developers are professional and strict about security and update rollouts, the plugin developers of plugin X might be pretty lax and slow to roll out a fix when there is an exploit dropped. Even if you shame them into getting better, the problem can start over with plugin Y instead, and so on. It's entirely possible that WebAssembly will also increase the attack surface, but I seriously doubt it will be at the same scope as the third party plugin providers. It will be developed by the same developers who developed the JavaScript engine of the browser.