>Calling the title misleading because they didn't breach the browser sandbox is wrong

By this logic we could also say that LinkedIn scans your home network.

Websites could scan your local network covertly up until a few years ago; now it requires explicit permission (like notifications, location, etc)