One allows a remote attacker to execute arbitrary code inside a sandbox, the other could result in loss of sensitive information.