A company's security policy states that all Web browsers must automatically delete their HTTP browser cookies upon terminating. What sort of security breach is this policy attempting to mitigate?

SQL injection targets server-side database queries and is not related to browser cookies stored on the client; deleting cookies has no effect on SQL injection attack surfaces.

HTTP session cookies store authentication tokens that websites use to recognize a logged-in user. If an attacker steals these cookies via XSS, network sniffing, or physical access, they can present them to the website and gain access as that user without needing credentials. Deleting cookies at session end ensures stolen cookies become immediately invalid once the legitimate user closes the browser.

Locally stored passwords in a password manager or browser vault are a separate storage mechanism from HTTP cookies, and clearing cookies does not protect those credential stores.

Browser usage pattern tracking through cookies is a privacy concern mitigated by this policy as a secondary effect, but it is not the primary security breach - session hijacking is the principal threat the policy addresses.