Assuming you're running Firefox as the outer browser too, in theory it only needs a single bug in the wasm runtime, plus a sandbox escape.