It is not a true sandbox. It is more a way to keep several "profiles" in a way similar to what Mozilla/Firefox have always done: basically, each such "user" will have his own set of cookies and browsing history, but, at the OS level, there is just one Chrome and one user account. The normal Chrome "sandboxing" is active in the following sense: code within one page shall not escape the browser and mess with the user's files (or, for that matter, with other pages or tabs). However, if malicious code does succeed in escaping that sandbox, then nothing will prevent it from altering the profiles of all "Chrome users" because the protection at that level is from the OS, and the OS is oblivious to this separation into multiple "Chrome users".
Chrome has long resisted adding such a feature, claiming that it was better to use several OS-level accounts. They were theoretically right, but it seems that market pressure trumps theory every time; and then they yielded.