> How do hackers steal a Google
> account or any other cookie by actually copying the victims cookie?

A user's session cookie is essentially their credential after they've been authenticated and until they are signed off. Its the token that each HTTP request needs to present to the server so that it knows the 'context' of the request.

Hence, if you obtain the session cookie of a logged in user, you can essentially impersonate him/her without actually knowing their password. A very common method to steal cookies are our beloved **XSS attacks**. However, a good combination of **CSP settings** and protections like **XSS auditor** combined with **httpOnly** cookies thwarts most XSS attacks. If you find one on gmail, you'll probably get a hefty sum of $$ via their bug bounty program ;)

CSRF is another way how attackers make servers perform changes that weren't authorized or initiated by the user. There was a cute CSRF attack on gmail where a attacker could send POST requests to create an email filter on user's account which will essentially forward a copy all emails to an email of attackers choice. Read about it at: https://www.wired.com/2007/09/gmail_flaw_lets_anyone_read_your_e-mail/

Obviously there are bunch of other attacks that can be leveraged to compromise user's account or data in some way or the other.