properly sandboxed iframe is pretty secure and qjs is big and written in C.

Anyway from a quick read I saw that plenty people use comlink with iframes, thanks though