From <a href="http://www.chromium.org/Home/chromium-security/security-faq" rel="nofollow">http://www.chromium.org/Home/chromium-security/security-faq</a>:<p>Why aren't physically-local attacks in Chrome's threat model?<p><i>People sometimes report that they can compromise Chrome by installing a malicious DLL on a computer in a place where Chrome will find it and load it. (See <a href="https://code.google.com/p/chromium/issues/detail?id=130284" rel="nofollow">https://code.google.com/p/chromium/issues/detail?id=130284</a> for one example.) People also sometimes report password disclosure using the Inspect Element feature (see e.g. <a href="https://code.google.com/p/chromium/issues/detail?id=126398" rel="nofollow">https://code.google.com/p/chromium/issues/detail?id=126398</a>).<p>We consider these attacks outside Chrome's threat model, because there is no way for Chrome (or any application) to defend against a malicious user who has managed to log into your computer as you, or who can run software with the privileges of your operating system user account. Such an attacker can modify executables and DLLs, change environment variables like PATH, change configuration files, read any data your user account owns, email it to themselves, and so on. Such an attacker has total control over your computer, and nothing Chrome can do would provide a serious guarantee of defense. This problem is not special to Chrome — all applications must trust the physically-local user.</i>