This functionality is not evident to the user. As per my understanding, unless the end user has given consent to control the DOM and the data in it, the application should not perform such actions. (Explicitly stated browser like applications can be considered an exception here.)
As per my understanding, this is a security flaw. Can anyone help me understand if this is an issue or not?
I wish I could share the exact scenario with more details, but if this is a security issue then I need to disclose it to the responsible party first.