Assuming that as you say you don't use a master password, and so the password database is stored in clear text:
It depends on what kind of malware you refer to.
If there is a 0day exploit (or you use an unpatched browser), which 'breaks out of', embedded in any of the things you mention, effectively causing arbitrary code execution on your host, then that malware will be able to recover the whole database (but that will be the least of your worries).
Again, if there is a unpatched flaw in the browser which the script takes advantage of, like breaking the Same Origin Policy protections of the browser, then it might be able recover any password from the database.
Finally, if the attacker can not 'trick the browser' (as in attacking a vulnerability), he may also in the end try to 'trick the user' - think social engineering - by using some subtle way to make it so that you send the database yourself without noticing it.