I which forms can visiting certain sites compromise one's system security, taking into account that browsers keep a sandbox for each opened page?

Nowadays, can a malicious -or attacked- site really, for instance, steal all stored passwords from a client or infect him with a virus?