> but can't prevent local privilege escalation from non browser clients That is such a different threat model though. A native app has a lot more permissions t

> but can't prevent local privilege escalation from non browser clients That is such a different threat model though. A native app has a lot more permissions than a web page. Trying to protect one native app from another is not really done much. Like, are MS Word documents encrypted so Slack can't read them from disk?