AFAIK only the PW is local, and signing is done via conjunction of the server key and PW. I think changing your PW would shut-off compromised browsers.
But if the attacker has the wherewithal to export the private key from within the account, you're out-of-luck for that address.
