What do you expect it to be "encrypted" with? Unless the user is entering a password every time they start the browser, there's nothing unique to a system that other malware can't just extract and use to decrypt the database.
> Keychain items can be shared only between apps from the same developer.
https://support.apple.com/guide/security/keychain-data-prote...
Instead the Windows API's have a symmetric encryption API (DPAPI) that allows developers to supply plain text, and receive cipher text.
It would then be up to developers to persist the cipher text.
DPAPI master key is protected by the OS, behind User Credentials.
a dodgy pypi package that can call CryptUnprotectData too
Windows doesn't have any application firewalls by default? I thought that was the whole thing that came in with Vista that people were upset about. (Of course, thinking it through, Linux isn't any better, assuming the process is running as the same user.)
It's definitely a ui feature. If you want to extract the password all you have to do is visit the login page, open the developer console, and type $("input[type=password]").value