An attacker could obtain the token from the browser's history. Note that this means the attacker needs access to the particular device.
OAuth 2.0 Threat Model and Security Considerations (RFC6819, section 4.4.2.2)
This threat is considered fully mitigated if all the test cases from the following test set succeed.
Back to the threat overview