Thanks for the report. Unfortunately it's very difficult for Chrome to protect against an attacker who has already compromised a machine (see https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#Why-arent-physically_local-attacks-in-Chromes-threat-model). But it would be good to verify that the Remote Debugging Protocol isn't inadvertently leaking information it shouldn't.

+some devtools folks - I suspect it's working as intended that the Remote Debugging protocol can see cookies in plaintext via the /json endpoint it accesses?

+skyostil re  http://crbug.com/668932 , which is referenced in the details here.

Thank you for filing the issue!

I have to say this is working as intended. The remote debugging protocol is meant to provide full access, including cookies, and running Chrome with a flag makes it work.

I am surprised cookies can be read from a headful Chrome profile by the headless Chrome. We have plans to make profiles inter-operable, but that didn't happen yet. Maybe cookies are supported though, I didn't look too close.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot