I think the surface mostly depends on how much you want to give the sandboxed application, not on the sandboxing technology you choose. If want to build somethi

I think the surface mostly depends on how much you want to give the sandboxed application, not on the sandboxing technology you choose. If want to build something emulating the capabilities of a desktop operating system including gfx acceleration (e.g. webgpu) then it will be much larger than some isolated compute function in the fashion of network edge workers. I am not aware of a single CVE against openbsd's pledge. On the other hand there are plenty of javascript engine escapes.