1. HOST APPLICATION (TRUSTED) 2. OUTER SANDBOX (RELAY / ORIGIN ISOLATION) 3. INNER APP (UNTRUSTED UI:// RESOURCE) postMessage JSON-RPC validate dispatch render ack HOST CORE RPC EMITTER IFRAME RELAY SEC CHECKPOINT UI ROUTER DOM RENDERER