It runs in a VM for precisely this reason. Look into the design docs and see how every piece is further locked down using minijail.