Implement a MAR decompressor/delta updater.
Long term, depending on Browser/updater
to apply MAR files is probably a poor decision. regardless of the fact that it's being fed trusted input in a network-less container.
So the sandbox should grow the ability to apply MAR files by itself.