[azakai]

CFI helps with control flow exploits, but it doesn't prevent memory corruption for example.

This sandboxing technique ensures that both control flow and memory accesses remain in the sandbox (except for when you explicitly allow otherwise).