> I could imagine doing a bunch of weird stuff where you don't know exactly what box you're typing in to. What stops malicious JavaScript that would have used

> I could imagine doing a bunch of weird stuff where you don't know exactly what box you're typing in to. What stops malicious JavaScript that would have used moveBefore() to just add key event listeners?