> Hold on, can't the same attacker now read my access tokens out of ~/.mozilla/firefox or ~/.config/chromium? You are correct. There is no such thing as "multi

> Hold on, can't the same attacker now read my access tokens out of ~/.mozilla/firefox or ~/.config/chromium? You are correct. There is no such thing as "multiple OS-level controls". In Google Chrome on Windows, the cookies in question are stored in an SQLite database at '%localappdata%\Google\Chrome\User Data\Default\Network\Cookies'. The cookie is named TSAUTHCOOKIE and contains an authentication token. There is the same level of protection on this file, as there is on the Microsoft Teams Cookies database. Source: I build forensics investigation tools for a living.