Not a security flaw, you just synced his browser settings with your account.
The proper way to log into another person's Chrome is by adding a new user in the "Personal Stuff" area first.
In some situations, the cookies we use to secure and authenticate your Google Account and store your preferences may be served from a different domain than the website you're visiting. This may happen, for example, if you visit websites with Google +1 buttons, or if you sign into a Google gadget on iGoogle.
Some browsers require third party cookies to use the P3P protocol to state their privacy practices. However, the P3P protocol was not designed with situations like these in mind. As a result, we've inserted a link into our cookies that directs users to a page where they can learn more about the privacy practices associated with these cookies.
Information that Google collects in association with these cookies is subject to our Privacy Policy.