I don't know exactly what NaCL does, but the JVM/CLR verification is all about making sure you don't write over someone else's memory, jump to some arbitrary address, etc. Essentially the problem is: how do you run untrusted code in the same address space, without it getting all of your process's permissions.

More info here: http://en.wikipedia.org/wiki/Java_Virtual_Machine#Bytecode_v...