Most browsers offer to save the password after entering it on many logon pages. What types of vulnerabilities are there for such saved passwords. I'm interested in what ways malware on web pages that are accessed later might be able to retrieve the passwords (or make use of them). Are there vulnerabilities from these things (or others)?:

* plain html
* javascript
* flash
* java
* pdf

I'm talking about vanilla password saving, not the (presumably) more-protected systems using things like master passwords as discussed in [this other question](https://security.stackexchange.com/questions/408/how-secure-are-my-passwords-in-the-hands-of-firefox-using-a-master-password).