Earlier quoted context omitted.
I really wish Android would properly enable containers like they've done for Chrome OS. It's silly we run little Linux machines and can't pop a fully isolated container shell on them!
I think it hasn't happened because much of the sandboxing of Android is part of the Android runtime, thereby only sandboxing code compiled for the Android runtime. If you could spawn a native Linux executable (that hasn't been compiled for Android the way the Termux executables have) from an Android application, then that process can escape the application's sandbox and do stuff it shouldn't be able to do given the p…
> ...then that process can escape the application's sandbox and do stuff it shouldn't be able to do given the permissions granted to the Android application.
Android's sandboxing is not limited to ART and has multiple layers [0]. Native apps cannot bypass sandboxing, I don't think.
[0] https://hernan.de/blog/tailoring-cve-2019-2215-to-achieve-ro...