Modern attackers are designing sandbox escapes that target your OS itself. Here's what CISOs need to know — and how to close the gap.