cordova-plugin-crosswalk-webview - Logging all UI interaction - including sensitive data
<p>This is an edited question - have got to the root of the problem so have added my own answer. 
Logcat was was outputting nearly every interaction with the UI, including what was typed our a password box (start of the word "password" highlighted with **):</p>

<pre><code>D/cr_Ime  (10392): [ImeAdapter.java:313] showSoftKeyboard
D/cr_Ime  (10392): [InputMethodManagerWrapper.java:47] showSoftInput
D/cr_Ime  (10392): [AdapterInputConnection.java:174] updateState [] [0 0] [-1 -1] [true]
D/cr_Ime  (10392): [ImeAdapter.java:387] dispatchKeyEvent: action [0], keycode [44]
D/cr_Ime  (10392): [AdapterInputConnection.java:393] sendKeyEvent [0] [44] [112]
D/cr_Ime  (10392): [AdapterInputConnection.java:239] updateSelectionIfRequired [1 1] [-1 -1]
D/cr_Ime  (10392): [InputMethodManagerWrapper.java:74] updateSelection: SEL [1, 1], COM [-1, -1]
D/cr_Ime  (10392): [ImeAdapter.java:253] updateKeyboardVisibility: type [2-&gt;2], flags [66], show [false], 
**D/cr_Ime  (10392): [AdapterInputConnection.java:174] updateState [p] [1 1] [-1 -1] [false]
D/cr_Ime  (10392): [ImeAdapter.java:387] dispatchKeyEvent: action [1], keycode [44]
D/cr_Ime  (10392): [AdapterInputConnection.java:393] sendKeyEvent [1] [44] [112]
D/cr_Ime  (10392): [ImeAdapter.java:387] dispatchKeyEvent: action [0], keycode [29]
D/cr_Ime  (10392): [AdapterInputConnection.java:393] sendKeyEvent [0] [29] [97]
D/cr_Ime  (10392): [AdapterInputConnection.java:239] updateSelectionIfRequired [2 2] [-1 -1]
D/cr_Ime  (10392): [InputMethodManagerWrapper.java:74] updateSelection: SEL [2, 2], COM [-1, -1]
D/cr_Ime  (10392): [ImeAdapter.java:253] updateKeyboardVisibility: type [2-&gt;2], flags [66], show [false], 
**D/cr_Ime  (10392): [AdapterInputConnection.java:174] updateState [•a] [2 2] [-1 -1] [false]
D/cr_Ime  (10392): [ImeAdapter.java:387] dispatchKeyEvent: action [1], keycode [29]
D/cr_Ime  (10392): [AdapterInputConnection.java:393] sendKeyEvent [1] [29] [97]
D/cr_Ime  (10392): [ImeAdapter.java:387] dispatchKeyEvent: action [0], keycode [47]
D/cr_Ime  (10392): [AdapterInputConnection.java:393] sendKeyEvent [0] [47] [115]
D/cr_Ime  (10392): [AdapterInputConnection.java:239] updateSelectionIfRequired [3 3] [-1 -1]
D/cr_Ime  (10392): [InputMethodManagerWrapper.java:74] updateSelection: SEL [3, 3], COM [-1, -1]
D/cr_Ime  (10392): [ImeAdapter.java:253] updateKeyboardVisibility: type [2-&gt;2], flags [66], show [false], 
**D/cr_Ime  (10392): [AdapterInputConnection.java:174] updateState [••s] [3 3] [-1 -1] [false]
</code></pre>

<p>In the mix <code>sendKeyEvent</code> is also outputting the ASCII/UTF code of the keypress. This is happening on both a Genymotion emulated device and an actual device - both using a release apk. In release mode this behaviour is even more stark- just the **'d log entries above are outputted, making it really easy to see what the password is:</p>

<pre><code>**D/cr_Ime  (10392): [AdapterInputConnection.java:174] updateState [p] [3 3] [-1 -1] [false]
**D/cr_Ime  (10392): [AdapterInputConnection.java:174] updateState [•a] [3 3] [-1 -1] [false]
**D/cr_Ime  (10392): [AdapterInputConnection.java:174] updateState [••s] [3 3] [-1 -1] [false]
**D/cr_Ime  (10392): [AdapterInputConnection.java:174] updateState [•••s] [3 3] [-1 -1] [false]
**D/cr_Ime  (10392): [AdapterInputConnection.java:174] updateState [••••s] [3 3] [-1 -1] [false]
</code></pre>

<p>Etc...</p>