[ragall]

A SPA can track the mouse cursor, as well as stealing form content that was left unsubmitted.

[detaro]

an MPA can use javascript that does exactly the same.

[adrr]

You don’t even need JavaScript. CSS has Hover attribute and you can use it to fire beacons.

[adrr]

Htmlx has a type ahead attribute that you can add to form elements and send the contents to an endpoint without the user explicit submitting the form.