I could not reproduce this. Logging out of Gmail in one tab means that Drive prompts for a password.

Can you give specific instructions on how to reproduce this, including:

1. Chrome version
2. Step-by-step repro

Thanks for prompt coming back

Version 54.0.2840.99m

you start with having gmail and drive logged in in two tab (for example )
- you close the drive tab (but don't logout)
- you logout from gmail and close the tab
- once you try to open a tab with gmail, a password is asked so you believe your data are safe.
- but if you open a drive tab no password is asked 
- from there if you click on the gmail icon once going in the "9 small square icon" in the up right of the drive screen you are prompted to gmail with no password to input

So basically, closing gmail is not enough to have it openable without a password input....
And this is reboot dependant : you can logout, close your laptop, have it stolen and the thief who can easily break the windows password can open you gmail....simply by going to drive first....

Here is the movie recorded with camtasia with how it happens

Thanks for this. I cannot open the recording file to verify your actions; can you possibly export it in MP4 format rather than TREC format?

Here is MP4 version. 
It is rather quick but I guess you can see what is going on clearly

Deleted: Google_gmail_breach.mp4 1.7 MB

	Google_gmail_breach.mp4 1.7 MB View Download

In the previous video you see clearly that the owner of the gmail account does believe that is is log of but in fact he is not as it is still possible to "enter his account" by entering into drive and move in between google pages from there.

I guess most people believing that they have closed there account are vulnerable to being hacked by the mean

And this way of "hacking" does not even require any computing skills..

I think I understand what is going on.

From your video, I can see that when you open "Gmail", you are actually opening "www.gmail.com/intl/fr/mail/help/about.html", which is the About page for Gmail. Clicking on "Se Connecter" always opens the login page, since it doesn't go straight to www.gmail.com.

What happens when you go to just mail.google.com? Or www.gmail.com? I believe that it would just open up your logged in email. It is a feature of Gmail (and many other sites, like Facebook) when you close the tab but don't log out, you can tell the site to remember that you are logged in. That is what is happening here. If you don't explicitly log out, you will stay logged in, and that's what you've done.

This isn't a Chrome feature - but it is a slightly confusing flow on the Gmail login page. Perhaps it would be a good idea to take this to the Gmail Product forums - I agree that it can be somewhat misleading to be taken to the login page. But it should be clear when you first logged in that the session is being persisted after you close the tab.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot