Sandboxie is a very popular and useful program for handling suspicious executables on Windows. Due to flawed security properties of Windows systems (eg. compared to Linuxes), it is hard to rely on the OS alone for containing threats, yet a full blown VM can have prohibitive performance cost. Sandboxie seems to offer a convenient middle ground, largely isolating processes without incurring the heavy cost of hardware emu/simu-lation.
However, how secure is Sandboxie, really? I am aware that even full VMs are not perfect, and exploits exist that allow a process inside to escalate into the host OS. Obviously these exploits are much rarer and more complicated to actually do, hence why people actually use VMs for security. Does Sandboxie offer comparable security to a VM, or even something like Linux jails? Or is it fraught with security holes due to being deployed on inherently inescure system (Windows) and being closed-source? What are the most egregious, known vulnerabilities in Sandboxie that have been observed in the wild?