> Backend and UI communication goes through in-process channels, not socket-based IPC

Are they running the frontend and backend in the same process? Sounds a bit dangerous security-wise?

How can in-process channels be more dangerous than a socket-based IPC? The frontend still goes through the "secure" JavaScript engine AFAICS.