WebAssembly starts a sandbox in microseconds and grants it nothing by default. Here is what that buys you outside the browser, and where the technology still falls short.