> another application could exploit Spectre to access your browser
I store them in Gnome Keyring. Which of course is still unsafe to Spectre. Nothing can save us from Spectre except a new CPU.
Recently I started doing something which is probably silly: if I have to enable JS for short in a particular website, I close all other programs and all other browser tabs. The idea is to have less info in the memory which could be broken into. However this may be a really silly overkill because certain data remains cached in memory even after the program is closed + that doesn't mean other processes are not running. So maybe I am just paranoid. It was so nice in single-tasking 16-bit times :)
