Only if they told the browser plugin to "store my master password." That shouldn't surprise anyone -- if the master password is stored somewhere that the plugin

Only if they told the browser plugin to "store my master password." That shouldn't surprise anyone -- if the master password is stored somewhere that the plugin can read it without any additional decryption keys, so can an attacker.