because now you have to think about the attack surface of the browser; CSRF, auditing your chrome extensions to try to make sure none of them are exfiltrating your tab contents / metadata, etc etc etc

Ahh shit, and i was just beginning to think that a site i found a while back (can't remember the name) which used a hash function to generate your passwords

hash(strong_master_pass + site + user)

was a perfect solution...

There's just so many things that could go wrong when you start trusting your web browser to access a password vault.