Nothing leaves the page, and that's not a pinky-promise, it's enforced by the browser itself (a Content-Security-Policy that blocks every outbound call). Once the page is loaded, every action runs ...