WASM offers a virtual machine to the user, in which there are global variable slots, a stack for local variables, and one or more "linear memories" (chunks of RAM for heap allocations). The first two are completely bounds-checked - you tell the virtual machine to operate on a certain offset in a global/local variable ID, and you are safe from your access affecting anything outside of that variable.

The linear memories, on the other hand, are up to you - you can execute operations on address within a linear memory, and it's up to you if you messed up and overwrote or read out data that you shouldn't have. What you do get is a) protection against heap overflows affecting values outside the heap, and b) protection against execution of heap data. In the future, they're also planning to support multiple linear memory segments, which would allow you to isolate memory used for potentially-buggy dynamically-allocated buffer code from memory used by less-fragile or more-sensitive code. WebAssembly.org's descriptions indicate that linear memories would be used both for C/C++ heap allocations and for any local/global variables accessed with operators (like the & reference operator) that make it hard to make these distinctions statically.

More information on the security properties of the system: http://webassembly.org/docs/security/

General information on linear memory semantics: http://webassembly.org/docs/semantics/#linear-memory

No, it's like a virtual proccess but with simpler memory layout. If you try to read or write memory outside of the allowed range it will trap (which is like segmentation fault on Linux) but it doesn't check any individual array for out of bound access because it doesn't actually know where are arrays in the memory.