When the user agrees to the sync, they unwittingly send all their local browser data, such as saved passwords, browsing ...
These ‘updates’ would be disguised as Chrome or Zoom installers, like ChromeUpdate and CameraAccess persistence modules ...