How do JavaScript closures work at a low level?

I understand that a closure is defined as:

[A] stack-frame which is not deallocated when the function returns. (as if a 'stack-frame' were malloc'ed instead of being on the stack!)

But I do not understand how this answer fits in the context of JavaScript's storage mehcanism. How does the interpreter keep track of these values? Is the brower's storage mechanism segmented in a way similar to the Heap and Stack?

An answer on this question: How do JavaScript closures work? Explains that:

[A] function reference also has a secret reference to the closure

What is the underlying mechanism behind this mysterious "secret reference?"