Actually there is a pointer lock api that allows apps to control user's mouse. And it can be added as a permission in chrome manifest. They only need the screen and mouse control. Which essentially means control entire machine.

Edit: never mind, I was thinking of chrome app, not the local plugin that we install for voice and video.