I've heard that too.. I know it's been attacked successfully at pwn2own a few times, and in the past the sandbox on e.g. Linux wasn't as restricted.

I think things have improved though.