What does the Chromium option `--no-sandbox` mean?

I'm running Chromium like so : chromium --no-sandbox I'm doing this because I'm running Debian Squeeze on an OpenVZ VM Container and it's the only way I can get it to work. Though I keep reading **this is terrible**. But I want to know why exactly. Can someone please explain it to me? Does someone need to hack into your computer to do damage? Or does the vulnerability come from a file on the web like a JavaScript file? What if I locked browsing down to only a handful of "trusted" sites? (Gmail, stackexchange (ofcourse), and facebook)