Author here - thanks for this! I was wondering why Wasm was RWX. My 2c: I think that there will be risk of code injection as long as write_protect_code_memory

Author here - thanks for this! I was wondering why Wasm was RWX. My 2c: I think that there will be risk of code injection as long as write_protect_code_memory in Heap is writable. Changing that flag will usually mess things up and crash writing to RX memory (CodeSpaceMemoryModificationScope won't switch to RW), but a well-crafted exploit might be able to get a fresh executable MemoryChunk (which will now be RWX). It's likely complex to exploit, but the incentive is that code injection is more reliable than ROP when targeting multiple builds (unless you build the chain dynamically, which is slow and often painful).