but anyone can do that. you don't need an API to tell you if the address has a balance if you have the private key, you just check your own copy of the blockchain.... just like they are doing...
When you visit a page, they generate all the private keys on the page and check for balances. If you happen upon a key that actually has a balance, they will clean it out before you can.
I kind of doubt it, the browser makes a request to blockchain.info to check the balances. If they wanted to do what you are saying they'd make that request somewhere one the backend.
