If that malicious addon/website can compromise your local machine then, yes the information can be accessed. Similarly, when you aren't using https the password is sent in plain text and could also be accessed then as well.