The important question (imho) would be: What can be done with this still open connection after the client closed the tab?

* Might the server use it for anything without my consent?

(e.g. hacking the sandbox as this state of the browser might open another code-tree with yet unknown security-bugs, or might still running js-scripts keep going in the background even after closing the tab?)

* Might the browser use it for anything without the server's consent?