All your eggs could be in one basket should your master password be compromised.

You could be at mercy to any vulnerabilities in the client-software or server-side storage (if applicable).

You're trusting software or service with your keys to the kingdom.

If they autofill password boxes without prompting, an XSS attack could grab the password should the site be vulnerable.

I would suggest the use of a browser based password manager to mitigate phishing, as your password will only be filled if the domain matches, although I've not seen any yet that protect against ssl strip style attacks (that is, they validate the domain, but not that the protocol is HTTPS).

Keyloggers may get your password, although if they do this your machine is compromised therefore you've already lost. I have not checked stay signed in at the Gmail login screen, and Ive set Firefox to delete all cookies when I close the browser.

You may be vulnerable to phishing unless you diligently check the domain and the HTTPS padlock each time.

Both mitigations assume your laptop is locked/logged out at the time of attack, preferably logged out to prevent cold boot attacks from reading the key from memory. This could be mitigated using disk encryption, or if using a browser that encrypts cookies like Chrome it can be mitigated with a strong password on your OS account. laptop stolen), could possibly allow access to all your logged in sessions.

If the application uses weak or predictable session tokens, yours could be brute forced.

CSRF and XSS attacks could be used to compromise your sessions, if the site in question is vulnerable.

Stay logged in to gmail