Capability security is great, but it isn't native to the Linux kernel. It must be implemented on top. WALI allows that capability security model to be implement

Capability security is great, but it isn't native to the Linux kernel. It must be implemented on top. WALI allows that capability security model to be implemented in a Wasm module, rather than built into the Wasm engine. Thus a bug in the implementation of that isn't an engine-level exploit, but is sandboxed as any other Wasm module would be.