Yes. It's explicitly not part of their threat model: https://www.chromium.org/Home/chromium-security/security-faq...