for kim woods only

Yes it is/was possible to escape the VM and and attack the host. Just to be clear a virtual machine with a shared host will have a base operating system with a virtualization software installed on top.  Then, multiple operating systems can be installed onto the machine.  The end result is many operating systems running on top of a base operating system.

In 2017 at the Pwn2Own hacking contest some hackers won a cash prize by exploiting a bug in Microsoft's Edge browser to gain access to the operating system kernel and escape the vm into the host.  

https://arstechnica.com/information-technology/2017/03/hack-that-escapes-vm-by-exploiting-edge-browser-fetches-105000-at-pwn2own/

How might such a thing shape your security policy?