According to https://www.theregister.com/2023/09/12/chrome_browser_webp_exploit/, a vulnerability has been discovered in the libwebp library, which is being patched by browsers. Since the polyfill uses this library, presumably you will want to update it with the patched version, even if Emscripten protects users from the exploit as a side-effect.