But websockets doesn't give you raw tcp, right? Do they have a proxy somewhere?
Not really a proxy - it's pppd in Linux with a vty redirected to a socket. More like a cloud-based dialup ISP that tunnels over existing connections than a proxy.
And it's not quite "the browser" in the usual sense, but Chrome Apps (and, I believe, extensions?) get access to TCP and UDP APIs: https://developer.chrome.com/apps/app_network