Through a privileged security barrier, which in practice would look like a separate API. That API would in turn make win32 (or UWP or whatever) calls.

At a minimum we'd need a separate API to enforce a web / mobile style security boundary.