[capocani]

Not a security flaw, you just synced his browser settings with your account. The proper way to log into another person's Chrome is by adding a new user in the "Personal Stuff" area first.

[skid]

I think the security flaw here is that google is keeping your password unhashed somewhere on their servers.

[capocani]

chrome://settings/syncSetup

Passwords are encrypted by default, the other option is to encrypt all synced data.

You should clear your friend's sync data from your dashboard BTW: https://www.google.com/dashboard/

[skid]

I guess it's ok. But they should make it more obvious when you first log into chrome.