Many users store their passwords exclusively in the browser, creating a huge opportunity for threat actors.