The cookies are stored in the device storage and an attacker with physical access to the device can steal the cookies.
