Comment by Delk

The sandboxed application would be something you explicitly chose to run. When the browser is the platform, every web page you visit has access to the general-purpose runtime. (Of course permission checks e.g. for microphones exist.)