The notification broadcaster has a signalR ping that has a time interval of 5 mins. Now if we have a custom implementation to timeout the user after 15 mins of inactivity on the browser / CME . This now keeps the session live even though the user is inactive.
This is a security issue and should be addressed in future release.