browsers can have security vulnerabilities in their complex parts that grant the website powers it shouldn't have. depending on the kind of vuln, it could enable readout of browser memory contents (like cookies containing access tokens), modification of it, execution of arbitrary program code supplied by the site, etc.