Is it possible to recover AES-GCM plaintext when having everything but the additional data? I'm using the window.crypto library in browsers.

I use iv from window.crypto.getRandomValues, key from window.crypto.subtle.generateKey, and additionalData from a user-input password.

After the encryption, I store iv, key, and encrypted_content in the local storage.

If someone gets these three things, is it possible for them to crack it without additionalData?
GCM is an authenticated wrapper around CTR mode. The authenticated data is only considered when verifing the authentication tag - after decrypting the data.

If your adversary has the $(\text{iv}, \text{key}, \text{ciphertext})$ they can recover the $\text{message}$ but they cannot detect tampering.

I recommend that you use Argon2i with a user's passphrase, running inside a WebWorker instead of the main thread such that you do not freeze the browser while computing the key. Do not store the key in localstorage. Similarly, do not store the key in any globally accessible variables I.e. not in window.mysecretkey!

Libsodium has an argon2i implementation and has been compiled to JavaScript/asm.js and WebAssembly.