The user can modify and delete anything stored in their browser. Any malware installed in the user's system with the user's privilege can also do so.
The system administrator can also modify and delete anything stored in any user's browser. Any malware with the administrator's privilege can do the same.
Another non privileged user in the same system generally won't be able to modify or delete another user's browser storages, however there's a number of other avenues of attacks that might be possible when an attacker have unfettered physical access, so don't rely heavily on it.
An attacker MITMing unencrypted connection between the user and your server can on some limited circumstances, modify and delete these storages.
An attacker MITMing a properly encrypted connection between the user and your server would not be able to do so. Improperly configured encryption may not give you effective security, so make sure you configure your encryption correctly and train your users not to ignore certificate errors and warnings.