This question already has an answer here:
I understand the part about a server with the vulnerability.
But from what I gather, the vulnerability has also existed in browsers that use the vulnerable OpenSSL implementations.
So, if I first visit a site that doesn't have a vulnerable OpenSSL implementation, log in then, and then afterwards (or perhaps through some obscure AD networks) gets routed to a malware server (that wouldn't normally be able to attack my computer), wouldn't this server be able to send an incorrect heart beat response back and thus get that 64KB from my browser sent to it?
So in essence, won't the Heart Bleed vulnerability in my browser mean that I could've potentially have leaked all data from my browser to a site?