I won't get into the details because there's tons of information out there (http://www.chromium.org/nativeclient/reference/research-pape...), but code must be compiled using a special NaCl compiler, then before it's executed the client runs it through the NaCl verifier to ensure it's safe to execute.

Of course it's possible there are bugs in NaCl, but Google won't enable it in Chrome by default until they're very confident it's secure.

It's possible that the design could be flawed, but the same is true for browser implementations and mobile application sandboxing.