What is WebAssembly (Wasm)? The tech that cut Figma's load time 3x became the box servers use to run untrusted code
WebAssembly (Wasm) is a binary format that runs code at near-native speed in browsers and on servers. Code written in C, C++, Rust, Go or C# is compiled to Wasm and run by a runtime. A module can see only its own memory and can use files or the network only if the runtime grants it, so Wasm is used beyond the browser — on servers, edge networks and plugin systems — as a box for running other people's code. It became a W3C standard in December 2019
The three lines
- Definition — a compile target, not a language; many languages run at near-native speed
- Safety — modules see only their own memory; files and network only if granted
- Uses — browser apps (Figma, Photoshop on the web) → servers, edge, plugins, AI code sandboxes
Key questions
- what is webassembly
- **A binary format for running code from many languages quickly and safely in browsers and on servers.** | Item | Detail | |---|---| | Name | WebAssembly, Wasm | | Announced | 2015 (major browser makers) | | Browser support | All major browsers, 2017 | | Standard | W3C Recommendation, December 2019 | | Languages | C, C++, Rust, Go, C# and more |
- webassembly vs javascript
- **JavaScript is a language people write; Wasm is a format compilers produce.** | | JavaScript | WebAssembly | |---|---|---| | Form | Text source | Binary | | Written by | People | Compilers from other languages | | Speed | Optimized at runtime | Precompiled, near native | | DOM access | Direct | Via JavaScript | | Relationship | Partners, not rivals | Handles heavy computation |
- why use wasm on the server
- **Small, fast to start and locked down by default.** | | Container | Wasm module | |---|---|---| | Default rights | Most OS features | None unless granted | | Startup | Typically hundreds of ms+ | Typically milliseconds | | Size | Tens to hundreds of MB | Usually a few MB or less | | Isolation boundary | OS kernel | The runtime |
WebAssembly isn't a language — it's an executable format. Compile code written in C, C++, Rust, Go or C# to Wasm, a compact binary, and a runtime in a browser or on a server runs it at close to native speed. Speed isn't the main point, though. A Wasm module cannot see outside its own memory, and it can use files or the network only if the runtime explicitly hands it those abilities. It is born in a box.
That property took Wasm beyond the browser to servers, edge networks and plugin systems as a box for running other people's code. It's also why October 2026's 9.9-rated sandbox escapes in the Wasmtime runtime drew attention: the more a box is used, the more its flaws matter.
1. Where it came from — a standard built by rival browser makers
| Year | Event |
|---|---|
| 2013 | Mozilla's asm.js — running C++ through a fast subset of JavaScript |
| 2015 | Major browser makers jointly announce WebAssembly in a W3C community group |
| 2017 | Chrome, Firefox, Safari and Edge all support Wasm |
| 2017 | Figma moves its C++ rendering engine to Wasm, cutting load time 3x |
| 2019 | Bytecode Alliance formed; WASI system interface for use outside the browser |
| Dec 2019 | W3C Recommendation (official standard) |
| Sep 2025 | Wasm 3.0 specification announced complete — garbage collection, 64-bit memory, exception handling and more |
For years browsers ran only JavaScript, and heavy graphics, 3D and video work was slow. Instead of competing formats, browser makers built one standard together. Today all four major engines run the same format.
2. How it works
| Step | Detail |
|---|---|
| ① Source | Write a program in C++, Rust, Go and so on |
| ② Compile | The compiler outputs a .wasm binary |
| ③ Validate | The runtime checks the module follows the rules |
| ④ Translate | The runtime's compiler (e.g., Wasmtime's Cranelift) emits CPU machine code |
| ⑤ Run | The module reads and writes only inside its own linear memory |
| ⑥ Outside world | Files, clocks, network only via functions the runtime passes in (WASI etc.) |
Safety comes in two layers: step ③ rejects rule-breaking code, and step ④ produces machine code that can't step outside the memory region. Both October 2026 Wasmtime flaws were in step ④ — translation errors. The original module obeyed the rules; the machine code didn't.
3. Does it replace JavaScript? No — they split the work
| JavaScript | WebAssembly | |
|---|---|---|
| Form | Text source | Binary |
| Written by | People | Compiled from other languages |
| Good at | UI, events, app flow | Image, video, 3D, crypto, physics |
| DOM access | Direct | Through JavaScript |
| Reusing old code | Rewrite for the web | Bring decades-old C/C++ libraries as-is |
Web apps typically use JavaScript for the interface and flow and Wasm for heavy engines. Figma's renderer, Photoshop on the web and AutoCAD on the web all brought desktop-class software into the browser this way.
4. Beyond the browser — the box for servers and plugins
| Use | Why Wasm | Examples |
|---|---|---|
| Edge and serverless functions | Starts in milliseconds; isolates customers | Fastly Compute (built on Wasmtime), Cloudflare Workers (supports Wasm) |
| Proxy extensions | Plug third-party filters into a server safely | Envoy proxy Wasm filters |
| App plugins | User extensions can't break the host | Plugin systems in editors and SaaS products |
| Running AI-generated code | Untrusted model output runs inside a box | Discussed as an agent sandbox option |
Compared with containers:
| Container | Wasm module | |
|---|---|---|
| Default rights | Most OS features (must be restricted) | None unless granted |
| Startup | Typically hundreds of ms or more | Typically milliseconds |
| Size | Tens to hundreds of MB | Usually a few MB or less |
| Isolation boundary | OS kernel | Wasm runtime |
| What breaks it | Kernel bugs | Runtime and compiler bugs |
The last row is the crux. A container's wall is the kernel; Wasm's wall is the runtime. So a compiler bug in a runtime like Wasmtime is, by definition, an escape bug. Even Kata Containers, which adds a VM layer around containers, was broken by OpenAI's red-team agents in October 2026. Whatever the box, the software that builds its walls is the target.
5. Major runtimes
| Runtime | Maintainer | Main use |
|---|---|---|
| V8, SpiderMonkey, JavaScriptCore | Google, Mozilla, Apple | Inside browsers |
| Wasmtime | Bytecode Alliance | Servers and embedding; leads on standards |
| Wasmer | Wasmer | Servers and desktop; package distribution |
| WasmEdge | CNCF project | Cloud-native and edge |
The Bytecode Alliance is a nonprofit founded in 2019 by Mozilla, Fastly, Intel and Red Hat to build Wasm for use outside the browser. Wasmtime ships security fixes for both long-term-support lines (such as 36.x) and newer lines — which is why the October 2026 fixes came as 36.0.19, 48.0.7 and 49.0.4.
6. FAQ
Is Wasm automatically safe? By design it is boxed in, but runtime bugs break the box, so keeping runtimes current is essential. Granting modules broad file or network rights also weakens the point of the box.
Is it always faster than JavaScript? For heavy computation, usually; for UI-heavy work that must go through JavaScript anyway, the gain is small.
How do I start? You don't need a new language. Point your Rust, C++ or Go toolchain at Wasm as a compile target.
Is it used by malware? In-browser cryptocurrency miners have used Wasm. The format itself is neutral.
7. What remains and what is unconfirmed
- Performance figures: container vs Wasm startup and size vary widely; the table shows typical ranges.
- New spec support: Wasm 3.0 features arrive at different times in different browsers and runtimes.