Comment by zwu-var

Not always. The safest way is to use a throwaway remote VM when dealing with untrusted content. Sandbox escaping is unlikely but still a risk on your laptop.