When you log into blockchain.info - you enter the password on the client side.

Does the password remain stored in a local javascript variable on the client side after the login process is over?

If yes, does that count as real a security risk? What kind of attack vectors does that open you to?

If not, how else does the wallet update the server side state?