Can Web Cryptography API's native key object be reverse engineered in any way? I do understand that the security of web cryptography API comes from how it encapsulates the key object natively and disallows its access from JavaScript context unless exported.

However I would like to go further, this security model is only secure if the hacker cannot reverse engineer the browser binary itself to somehow figure out the key. I've been looking for a source on how the technology is actually implemented by browsers internally.

Is there a guarantee that a malicious actor cannot break into a browser and extract out keys "natively" instead? Are the keys stored encrypted internally somehow?
The Web Crypto API isn't intended to stop users from getting their own keys, or guaranteeing that to web pages. The Web Crypto API allows web pages to create and use private keys that the web page (and future versions of the web page) can not access; the API is about protecting web pages' keys from themselves.