You can't take over the browser without chaining to a browser exploit, which is a much higher bar. If you already have a browser exploit I think you are unlikel

You can't take over the browser without chaining to a browser exploit, which is a much higher bar. If you already have a browser exploit I think you are unlikely to need to chain it from a wasm binary. You can potentially take over the page, but again only if you have vulnerabilities in the JavaScript interfacing with the wasm code. There is only one browser-based example in the paper and the vulnerability is due to using document.write which is always a security no-no.