A company's security policy states that all Web browsers must automatically delete their HTTP browser cookies upon terminating. What sort of security breach is this policy attempting to mitigate?

SQL credential attacks exploit server-side injection vulnerabilities in database queries and are not related to client-side browser cookie storage or deletion.

HTTP session cookies typically contain session tokens that websites use to recognize an already-authenticated user; if an attacker steals these cookies via cross-site scripting, network interception, or physical access to the machine, they can replay them to impersonate the user on any trusting site. Deleting cookies at browser termination eliminates persistent session tokens, ensuring that a stolen cookie from a closed session cannot be used to gain unauthorized access to sites that trust that browser session.

Locally stored passwords are protected by operating system access controls and credential vault mechanisms, not by browser cookie lifecycle policies.

While cookies can be used for behavioral tracking, the security policy specifically targets session token persistence, making session hijacking the primary threat being mitigated rather than browsing pattern surveillance.