Chrome and Firefox both store cookies, bookmarks, etc. in unencrypted, unprotected sqlite databases in a user profile directory. Internet Explorer stores them i

Chrome and Firefox both store cookies, bookmarks, etc. in unencrypted, unprotected sqlite databases in a user profile directory. Internet Explorer stores them in regular text files on the filesystem. Any application run by the same user has trivial access to all of that information. In many cases that information can't be sent out to an external server and then used to impersonate you, however. Google, for example, has a lot of safeguards to identify abnormal traffic like that and block it out. An application could, however, use the cookies/session info locally on your machine to do things without your knowledge.