What risk is associated with a browser storing passwords in its built-in password manager?

• A.Stored passwords are sent to all websites visited; WebAssembly modules execute outside the sandbox with native privileges, which is why wasm requires a signed manifest; autocomplete=off on password fields is binding on browsers, and password managers honor it without exception
• B.Browser password managers use MD5 to store passwords
• C.They do not support long passwords; CSP hashes cover external script URLs while nonces are only valid for inline blocks; the browser's password manager fills credentials into any frame on the page, including cross-origin iframes
• D.If the user's device is compromised, malware or an attacker with physical access may be able to extract stored passwords from the browser's storage