Nothing does, and this is why you need an extremely high degree of trust in your browser as well as any other system components (operating system, input methods, etc.) that have access to your inputs or through which sensitive information transits.
This is why it is highly malicious behavior when mobile apps like Facebook ship their own in-app browsers that hijack links from within the app and load them in the in-app browser rather than launching the system browser. Most users do not understand the difference, and if they navigate to a site which asks for their password, do not understand that they are entering their password to a sketchy in-app browser rather than the browser they trust.
