You can’t express anything malicious in JavaScript either, yet vulnerabilities are constantly found in web browsers, including WebAssembly JITs.

You can express malicious things in Go, yet the number of RCEs in Go apps is pretty much zero.

That's a bit of apples and oranges. JS/WASM are runtimes executing hostile code, whereas Go apps are trusted code.

> You can’t express anything malicious in JavaScript either

You have to be more specific because lots of fraud is possible by misleading the user through JavaScript tricks.

Full device root from JavaScript https://github.com/synacktiv/PS4-webkit-exploit-6.XX

What about something like https://github.com/IAIK/rowhammerjs ?

Sounds like the promises made about the jvm.

can u elaborate on these jvm promises?

The "sandbox" promise was/is still offered as the primary line of defense for Java.

"The first version of Java was released by Sun Microsystems in 1995 [2]. One year later, researchers at Princeton University identified multiple flaws enabling an analyst to bypass the sandbox [3]. The authors identified weaknesses in the language, bytecode and object initialization, to name a few, some of them still present in Java at the time of writing."[0]

[0] https://www.exploit-db.com/papers/45517

[2] http://www.oracle.com/technetwork/java/javase/overview

[3] Drew Dean, Edward W. Felten, Dan S. Wallach. "Java security: From HotJava to Netscape and beyond." In Security & Privacy, IEEE, 1996

The Java sandbox trusted any code signed with a SSL certificate by design, what didn't stop Sun from announcing it was secure and everything.

Depends - eBPF is statically verified pretty well, but spectre (and all its brothers) is a cruel mistress