They can just change their JavaScript to capture your master password, or change it to send all of your passwords to them after decryption. Even if that proble

They can just change their JavaScript to capture your master password, or change it to send all of your passwords to them after decryption. Even if that problem didn't exist, I'm not sure I'd want all of my passwords anywhere in browser memory.