This is not correct. When I run it on IE, first it asks permission to run ActiveX controls on my browser, which I don't allow if I trust.
Then of course, it is just like Flash, it can track your mouse.
Then of course, it is just like Flash, it can track your mouse.
Edit: I am one of the authors of the demo code included in the disclosure.