I'm not sure what you mean, a webpage can't just randomly snoop on all your device's keystrokes if you don't have it open AFAIK. Do you have an example of this?

I'm not sure what you mean, a webpage can't just randomly snoop on all your device's keystrokes if you don't have it open AFAIK. Do you have an example of this? Browsers already use a sandbox + permission model very similar to mobile. A webpage can't just silently obtain your location data, for example, it has to ask permission first. Any hypothetical hardware API will probably use the same permission flow.