In terms of security, sandboxie comes out on top.
To quote wikipedia
Sandboxie is a sandbox-based isolation program developed by Ronen
Tzur, for 32- and 64-bit Windows NT-based operating systems.It creates
a sandbox-like isolated operating environment in which applications
can be run or installed without permanently modifying the local or
mapped drive.An isolated virtual environment allows controlled testing
of untrusted programs and web surfing.
Wine on the other hand:
Wine is a compatibility layer. It duplicates functions of Windows by
providing alternative implementations of the DLLs that Windows
programs call, and a process to substitute for the Windows NT kernel.
This method of duplication differs from other methods that might also
be considered emulation, where Windows programs run in a virtual
Because of Wine's ability to run Windows binary code, concerns have
been raised over native Windows viruses and malware affecting
Unix-like operating systems. Wine can run most malware, but programs
running in Wine are confined to the current user's privileges,
restricting some undesirable consequences. For this reason the
developers of Wine recommend never running it as the superuser.
Malware research software such as ZeroWine runs Wine on Linux in a
virtual machine, to keep the malware completely isolated from the host
system. Another security concern is when the implemented
specifications are ill-designed and allow for security compromise.
Because Wine implements these specs, it will also implement any
security vulnerabilities they contain.
In summary, yes, Sandboxie is (theoretically anyway) safer than Wine.
Additionally, Wine is not an emulator, even though it shares emulator characteristics.
The name Wine initially was an acronym for WINdows Emulator. Its
meaning later shifted to the recursive backronym, Wine Is Not an
Emulator in order to differentiate the software from other emulators
It seems like the information regarding memory usage and protections around it is lacking. Based on the following i've read on their FAQ
The following classes of system objects are supervised by Sandboxie:
Files, Disk Devices, Registry Keys, Process and Thread objects, Driver
objects, and objects used for Inter-process communication: Named Pipes
and Mailbox Objects, Events, Mutexs (Mutants in NT speak), Semaphores,
Sections and LPC Ports. For some more information on this, see Sandbox
Sandboxie also takes measures to prevent programs executing inside the
sandbox from hijacking non-sandboxed programs and using them as a
vehicle to operate outside the sandbox.
Sandboxie also prevents programs executing inside the sandbox from
loading drivers directly. It also prevents programs from asking a
central system component, known as the Service Control Manager, to
load drivers on their behalf. In this way, drivers, and more
importantly, rootkits, cannot be installed by a sandboxed program.
It appears that:
Memory access is not restricted in any extra-ordinary way and that programs execute and are given the ability to read most data on the system. You might not be able to install persistent malware on a system but i believe malware could run from the memory and perform malicious actions (say for example, sending email from your browser, stealing cookies etc)
Hope that helps!