“This makes it safe to execute untrusted, 3rd party plug-in code even while it’s directly embedded within the same OS process as your program.”
Running untrusted code inside your own process is usually how security postmortems start. The bet is that the WebAssembly sandbox holds. It’s a Rust core with SDKs for 13 languages under a BSD license. The free runtime is the hook, and a hosted product is the obvious next step.