Most browsers store passwords unencrypted. A basic rule of security is that physical access means all bets are off. Only disk encryption will save you against physical access.