[Xylakant]

No, there's a reason password managers should be preferred. For example, sometimes (browser) sandbox escapes grant reading of arbitrary files. Take for example the recently discussed malware scanner the sent the browsing history, it could read such a file and transfer it back.

[UncleMeat]

If you have malware on your device you lose already. It can just read memory out of your browser process and steal your passwords.

[thaumaturgy]

"Just".

Modern browsers and OS kernels have extensive mitigations against this. Reliably extracting a password from a browser process's heap would be newsworthy today.

[rileymat2]

I think “just” is apt. If you have a web request to send the password, you will have a url or username string very close by in memory that can be searched for.

[Xylakant]

I specifically picked an example of a malware that was capable of reading arbitrary files, but not arbitrary memory because the authors found a simple way to trick users into granting them this permission set, but not another.

A sandbox escape that allows the attacker to trick the browser into sending arbitrary files back is also substantially different to having malware on your system that can read arbitrary memory.