What is an iOS App Extension, and what security boundary separates it from the containing app?

• A.An App Extension runs inside the system daemon process, because SpringBoard hosts the extension's view controller for the presenting app (the extension inherits the daemon's entitlement set); the boundary is a UI one only, never a process boundary, leaving the containing app's memory reachable from extension code
• B.An App Extension runs as a separate process with its own sandbox; it cannot directly access the containing app's memory, file system (outside shared containers), or Keychain (outside shared access groups), limiting the impact of a vulnerability in the extension
• C.An App Extension shares the containing app's process for performance reasons, since loading a second address space would slow the share sheet (the bundle is loaded into the host at activation); the extension therefore reaches all of the app's memory, its files, its Keychain items, without restriction