Honestly, I don't think I am. This is a rather new resurgence, but within a short enough time frame, this will be possible with greater accuracy, especially with large enough data samples. Passwords are a repeated pattern, it's not too difficult to look for them. Once then compared to other known user input and sensor data, generating an accurate, or even close estimate, becomes reasonable. Obviously this isn't going to be a widespread exploit tomorrow, but this is the tip of the iceberg. The use of phone sensors to decipher sensitive information will grow substantially.

No, they wouldn't, as I indicated in my initial reply. This is really basic web development here. Mobile web pages are not active when they are not the foreground tab in the foreground app, so unless you're on the actual web page it would not be able to read any data.

Yes, in my contrived scenario, the webpage is on the foreground. You would be logging into a website in which you needed to enter your password. A malicious script could be listening and recording sensor data during this ordeal.