I suppose if we store it like that, a malware could read it easily, it's surely why the WebCrypto API can wrap the key with another key, so that the private key can be stored in IndexedDB encrypted. The wrapping key is stored on the server side and sent to the client after a successful authentification.
So, if the browser is closed, the malware should be able to get the private key but it's encrypted and in theory useless (excepted for brute-force attack).
But if the browser is opened, and the user log in, the server send the secret key to unwrap the private key. So at this moment, is it possible for a malware to read the network trafic, RAM, files, caches, to read/extract the unencrypted private key?
About the network trafic, I assume it's all in HTTPS, TLS 1.2 minimum with robust cipher suite, with HSTS set to max age including sub-domains, and with HPKP to prevent MITM attacks.