Your data is stored in files under your user profile. Programs running under your user account (or as root) can read any file in your user profile. The data formats differ between browsers, but all major browsers have code to import profiles from all other major browsers as part of their "make it easy for users to switch to using us" strategies. The only way you could prevent such cross-application data sharing would be to use some kind of sandboxing (run each browser in a different
chroot, or a different VM, or as different users), or for the browser developers to make it possible to do things like encrypt the data files with a user-supplied password, and then you could just not supply Chromium the password for Firefox's data.
Of course, all of that only answers the "How" portion of the question. There's still a "Why" question, since usually such data import requires explicit user action and I would not expect it at all when launched with a
--temp-profile parameter, but there we couled only speculate (or ask the developers).