Chrome Android private-data exfiltration via file picker

Tap the button below, then choose Evil File Picker from the Android app chooser. Chrome will hand this page a File object backed by its own private cookie database (/data/data/<chrome-pkg>/app_chrome/Default/Cookies).