Presumably, yes. If you read the comments here they imply that Chrome does not encrypt cookies and you can simply copy your user profile to another PC and Chrome will start using those cookies.
Substitute "you can simply copy your user profile to another PC" with "an attack can copy your user profile to their PC"
Or, a local application could make a copy of it. This thread has a Python script for exporting your Chrome cookies.
I can't tell if
surfasb is trolling or just doesn't understand how HTTP works. Unencrypted cookies are the attack vector Firesheep uses. Whether it gets it off the wire or off the disk is unimportant. Once you have the cookie, you're in.
Here's a small example to "trick" Google into thinking that netcat is Chrome. Note that Google doesn't care what my browser is, just that I have the cookies Google gave me that identifies me to Google.
GET http://www.google.com.au/ HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.112 Safari/535.1
request_cookie.txt is the same as the above, but with my
NID cookies for
.google.com. I'm not going to show you them, because they're mine :)
These two commands send the requests to Google and then save the response.
type request_nocookie.txt | nc www.google.com 80 > response_nocookie.txt
type request_cookie.txt | nc www.google.com 80 > response_cookie.txt
Now that we have the responses...
find "Todd" < response_nocookie.txt > NUL
A non-zero error level is failure. My name doesn't appear in the response, because without the cookies Google doesn't know about me.
What about when we have the cookie?
find "Todd" < response_cookie.txt > NUL
A zero error level is success - we've found my name in the response! It's actually there a few times, because the toolbar up the top has a bunch of stuff relating to my Google Plus account.
I'll leave this as an exercise to the reader: if you really want to you can let yourself in to a Google Plus account with some slightly better tools. Google Plus requires SSL (which doesn't make it any more secure to a user taking the cookies off the disk, but it does stop Firesheep).