`info_cache` keys are directory names from the browser's own metadata file,
which anything running as the user can write. A key like `../../../../secrets`
was returned as a profile and handed to `cookieDatabasePath`, so the import
would read a database outside the browser's user-data directory — the same
escape the IPC-side guard closes, reached through the other door.

Only a single plain path segment is accepted now.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>