This paper is important. It doesn't point out anything that you shouldn't already know if you're an experienced systems programmer, but may be a good reminder that WebAssembly's sandbox isn't the last word on security. You still need to be on alert for things that can trigger XSS, which can be easier when you have a memory unsafe language like C or C++ in your stack.

There's a good point in there about how node.js is exposed to all these vulnerabilities too.