I'm fairly sure this is working as intended, but passing this along to the sync team. I'm also removing security labels as this would require either having access to the account to begin with, or physical access to a device for it to be exploited.

See https://www.chromium.org/Home/chromium-security/security-faq#TOC-Why-aren-t-physically-local-attacks-in-Chrome-s-threat-model- for more information.

This is working as intended. Signing out of chrome or revoking access by changing password prevents chrome from syncing with server, but doesn't clear local data.
This behavior is explained in help article: https://support.google.com/chrome/answer/2390059

I think we should local data automatically deleted after change the password or sign out in chrom.
It is more stable security
Thanks for the reply