Don't trust Android or iOS or macOS sandbox. Google invests huge amounts of development time and research into Google Chrome JavaScript sandbox. It is the real wild west, there are malicious actors who want to break that sandbox. There are multiple layers of protection. Yet there are successful attacks. Much less people trying to break Android or iOS sandbox, because you can just ask for permission from Android and because Apple can kick bad app from the store and prevent infestation. It means that security of those sandboxes is worse, there are many undiscovered (or undisclosed) holes.

Check out history of Java sandbox with its numerous vulnerabilities. I have no reasons to expect anything different from built-in sandboxes. It's like relying on unix user permissions and allow to run anything under untrusted user. Works in theory, but you'll be owned pretty soon, because local root escalation vulnerabilities are not that rare.

In those days the only sandbox I would trust is JavaScript one. It's battle tested.