Cross-subdomain cookie theft via scoping

A session cookie scoped to the parent domain is readable and settable by any subdomain, including one you can control.