Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
A fresh incognito browser will not have access to any cookies
An active session however, will surely save cookies somewhere so I don't have to login to gmail every time I access gmail.com in the same web-browser session
My question is: does incognito mode prevent 100% of cookie-stealing methods of identify fraud
I'm assuming that since you've indicated incognito mode, that you are not talking about attacks where an actor has code running on your machine or remote access.
Cookies are stored on your computer and linked to a specific website that has requested them. When you get a cookie from gmail at login, it will be presented to gmail on every subsequent request from that browser session and (as you correctly identified) would not be presented to gmail if you were in incognito. However, you don't need to be in incognito for your cookie from gmail to be kept secrete from any other website.
For an exploit to get a cookie from your browser that doesn't belong to it, you'd have to break the sandbox. This could get you access to cookies that were not intended for the website. Since each tab/window of chrome are separate processes, you do get more isolation by using incognito.
does incognito mode prevent 100% of cookie-stealing methods of identify fraud
No, there is nothing you can do to prevent anything 100%. There is no such thing as being "Secure" only "More Secure". If someone hits you with a browser escape and a privilege escalation, they can do anything they want on your machine including stealing your cookies.
