When WebAssembly is further along the capabilities of PNaCl should be polyfillable to WebAssembly, and it would then make sense to ship one fewer VM. Otherwise NaCl and PNaCl have a solid track record of running code near native speed in an extremely secure sandbox. It's under Chrome's Vulnerability Reward Program, you're welcome to look for payoffs ;-)