It would be a technical challenge, but they could MITM your entire browsing experience. Fullscreen to canvas, then show what looks like a browser. When someon

It would be a technical challenge, but they could MITM your entire browsing experience. Fullscreen to canvas, then show what looks like a browser. When someone types something in the URL bar the attacker's backend proxies a request to the real site, loads the content, then renders a canvas page of it. It would probably be too much work for too little payoff to actually make a browser that rendered to canvas, but they could do it for a couple of major target sites like gmail and banks.