Malicious actors can access client-side cookies or local storage in a number of ways:
Cross-Site Scripting (XSS): An attacker can use a vulnerability in your web application to inject malicious code that can steal cookies or local storage data from your users. This can happen when your application does not properly sanitize user input, which allows an attacker to inject malicious code into your website.
Man-in-the-Middle (MitM) Attack: An attacker can intercept network traffic between the user's browser and your website and steal cookies or local storage data. This can happen when the user is connected to a public Wi-Fi network or when the attacker has control of the user's DNS settings.
Malicious Extension: A malicious browser extension can steal cookies or local storage data from the user's browser. This can happen when the user installs a malicious extension that is disguised as a legitimate one.
Malicious Website: A malicious website can steal cookies or local storage data from the user's browser. This can happen when the user visits a website that has been compromised by an attacker.
It's important to use secure storage mechanisms for sensitive data such as access tokens, and avoid storing them in client-side storage.