> JS doesn't have such things
Even if your JIT compiler does not generate such code for certain use-cases, WebAssembly does have pointer support. It also has exception handling (e.g. longjmp) and shared memory, — both highly helpful in exploiting these vulnerabilities.