Perhaps it's not the browser leaking it, maybe there's some other native code running that's watching window movements and resizing events, then it's sending that to the JS.
I was thinking perhaps the OS has accessibility APIs that provide this info. For example, this application uses some form of accessibility APIs, if I'm not mistaken, to overlay things on screen - https://www.homerow.app/