Does blockchain.info retain the wallet password in client-side memory? When you log into blockchain.info - you enter the password on the client side.

Does the password remain stored in a local javascript variable on the client side after the login process is over?

If yes, does that count as real a security risk? What kind of attack vectors does that open you to?

If not, how else does the wallet update the server side state?
I guess that it must have, because it updates the server after any modifying operation is made, without asking for a password.

That is DannyHamilton claims as well. See also.