Starting with Windows 10 May 2019 update, there is a new Windows Sandbox feature, which, despite its name, is based on Windows Containers.
You have have read that CheckPoint, a cyber security research company, has identified vulnerabilities that may allow an attacker to compromise your computer using malicious subtitle files downloaded by popular media players including Kodi and VLC. It's not clear if this affects macOS too, but in light of this threat, here is a summary of how I further "lockdown" any apps I'm unsure of...
Since 2012, all apps on the Mac App Store must run in an app sandbox, which restricts access to system resources unless explicitly required. The secure sandbox isolates the app and defines access controls, protecting users from malicious code with undesired behaviour.
Here's how to setup a sandbox for an app downloaded from outside the Mac App Store.