Cross-subdomain cookie theft via scoping

Cookies set on .target.com are shared with every subdomain. If any subdomain is attacker-influenced (takeover, user content, a vulnerable app), it can read or overwrite the session cookie.

# check scope and flags
curl -sI https://target/login | grep -i set-cookie
# Set-Cookie: session=...; Domain=.target.com; Secure  (no HttpOnly? no __Host-?)

From a controlled subdomain, exfiltrate or fixate.

document.cookie = "session=attacker; domain=.target.com; path=/";

Pro note: the strong fix is the __Host- prefix, which forbids Domain and forces Secure and Path=/, isolating the cookie to the exact host. Flag any auth cookie without HttpOnly, without __Host-, or scoped to the apex when a subdomain takeover is plausible.