CWAMR: Reimagining A Capability based Webassembly Runtime Via Cheri-Based Compartmentalization

WebAssembly (WASM) provides a language-neutral execution format widely deployed for cloud, edge, and embedded workloads. Its linear memory model and software-level sandboxing afford portability and a baseline of spatial isolation, yet they rely on dynamic bounds checks and page-based protections that incur overhead and remain susceptible to violations under speculative and out-of-order execution. Prior efforts to secure WASM for untrusted workloads frequently embed it within Trusted Execution Environments (TEEs) such as Intel SGX, introducing attestation, enclave management complexity, and exposure to shared-cache side channels, while still lacking hardware-enforced pointer provenance and bounds.