Consider, for a moment, the case of Virtualbox. When a keystroke is made on the keyboard, how does it get into the virtual machine? It travels through the host's kernel, gets passed to Java, which in turn passes it to the virtual machine to be processed.

There is plenty of opportunity for interception here.

Premise of my statements:
Most malware is written for Windows platforms.
Most people who use Windows + VMs will wind up using Virtualbox or VMWare.
If you kill the correct java.exe process, your VM shuts down immediately.

You don't need to actually fuck with the VM's memory space, you own the whole galaxy.

If they can get physical access to the device, unsupervised, then your concern is if they tamper with it. Especially if you have an unencrypted Windows install. (Gives them an easier way to offload the logged keystrokes without risking damaging the integrity of the encrypted HD.)

Doubly so if you have an encrypted VM and your host gets compromised.

Storing data in a variable is all fine and well, but it's not logging anything. Logging -> writing to persistent storage (on disk, shm, sqlite db in RAM, sending it over a network, etc)

Also, this will only log what is being typed within the context of a browser window and has no bearing on what users type in other applications.