I downloaded the new Yandex Alpha browser. When installing, I chose not to make it the default browser and not to send anonymous usage statistics. I never got a prompt whether I wanted to import passwords, history or anything else - these two questions were the only ones I had to answer. I didn't have any version of Yandex browser or Yandex Alpha browser installed before.
Now when I first opened the browser, I came to a page with my most visited webpages, which was imported from Chrome - okay, I'm fine with that, although it would've been nice if they would've asked me whether I wanted that or not. But more importantly I noticed that when I opened a StackExchange site, I was already logged in. The same with Facebook and other sites. How's that possible? Could Yandex Alpha steal the PHPSESSID cookie and is that enough?
My Facebook password has not been saved in any of the browsers I have installed. Also, Facebook is supposed to give me a notification when I log in from an unknown location, which normally also happens if I use another browser. But with Yandex Alpha I did not get such a notification.
Does this point to a security problem? Doesn't this mean that any program can steal my session from my browser and pretend to be me on whatever website?