diff --git a/src/main/browser/browser-cookie-import.ts b/src/main/browser/browser-cookie-import.ts
index 7079141f4e6..8a26e657794 100644
--- a/src/main/browser/browser-cookie-import.ts
+++ b/src/main/browser/browser-cookie-import.ts
@@ -5,6 +5,7 @@ import { execFileSync } from 'node:child_process'
 import { createDecipheriv, pbkdf2Sync, randomUUID } from 'node:crypto'
 import {
   appendFileSync,
+  chmodSync,
   copyFileSync,
   existsSync,
   mkdtempSync,
@@ -1515,8 +1516,13 @@ export async function importCookiesFromBrowser(
     `Cookies-${partitionSegment}-${Date.now()}-${randomUUID()}`
   )
   try {
-    mkdirSync(stagingDir, { recursive: true })
+    // Why: the staged copy is a full cookie DB (session tokens). Lock the dir
+    // and file to the current user so another local account cannot read them —
+    // recursive mkdir leaves an existing dir's mode untouched, so set it too.
+    mkdirSync(stagingDir, { recursive: true, mode: 0o700 })
+    chmodSync(stagingDir, 0o700)
     copyFileSync(liveCookiesPath, stagingCookiesPath)
+    chmodSync(stagingCookiesPath, 0o600)
   } catch {
     rmSync(tmpDir, { recursive: true, force: true })
     return { ok: false, reason: 'Could not create staging cookie database.' }