Would it not be possible to present a sensitive page in a full-screen iframe, and then capture an approximation of what the user entered into that iframe by picking up accelerometer events from the outer page? Not a perfect hack by any stretch, since the URL would be wrong, but potentially problematic.