Indeed running a VM is an exploiter's dream, unless the VM is essentially run by a hardware hypervisor (akin to Android's system).