The best I can come up with is that this is some kind of novel abuse of Web Workers or other PWA technologies that, while never escaping the sandbox, effectivel

The best I can come up with is that this is some kind of novel abuse of Web Workers or other PWA technologies that, while never escaping the sandbox, effectively implements a spyware payload within constraints that were previously thought sufficient to prevent such attacks.