document Vanadium blocking dynamic native code exec

static/features.html

@@ -954,6 +954,8 @@
                         <li>Strict site isolation and sandboxed iframes</li>
                         <li>JavaScript JIT disabled by default with per-site toggle via drop-down
                         permission menu</li>
+                        <li>Dynamic code execution is blocked when the JIT is enabled as an
+                        extension to the seccomp-bpf sandbox</li>
                         <li>Native Android autofill implementation to avoid needing sandboxed Google
                         Play for autofill support</li>
                         <li>WebGPU disabled for attack surface reduction</li>