Suppose I found a XSS bug in a eCommerce website. Can we steal the victim's cookies from their bank website (if that is opened in another tab)?

3 Answers 3


Depends on how well the browser has implemented tab separation and cross-site origin policy. In modern browsers, no, you won't be able to do that. It would be possible to write a non-standard conforming browser that would allow you to access third party cookies, but at that point, the attacker can do much more interesting things, so being able to steal cookies is pointless.

In old browsers (very old browsers - I'm talking pre-IE4 era, if not even earlier), it's possible various tricks would get the browser to send the wrong cookies, but these are relatively easy bugs to pick up with automated testing, so they should have been fixed a long time ago.

The responsible thing to do in this circumstance is to let the ecommerce provider know about the XSS issue, providing all the details they need to recreate it, so they can fix it. They might even give you a reward, depending on their policy. However, it is usually illegal to go looking for issues without permission from the site owner - if they have a bug bounty programme, they will usually mention it somewhere, along with restrictions on the kinds of investigation they allow.

  • 1
    There also seem to be modern browsers that disable the Same-Origin-Policy, like Comodo one: code.google.com/p/google-security-research/issues/detail?id=704
    – Jyo de Lys
    Feb 4, 2016 at 13:41
  • 2
    I would dispute that it is really a browser! It's a piece of malware which has a whole bunch of other dodgy features - they've essentially written their own non-standard conforming browser...
    – Matthew
    Feb 4, 2016 at 13:44
  • using Reflected XSS - could we not send a link for eCommerce app to the user, along with some nifty js code that steals that cookie? (presumption is that we know that user is using this app)
    – monolith
    Jan 20, 2020 at 18:24

No, otherwise anyone could make a website with an XSS vulnerability, get the victim to visit it and then they would be able to steal all the user's session cookies.

Also, XSS isn't anything about tabs.


In google chrome each tab is a separate process, isolating access from other tabs, so traditional cookies are not accessible to a JS script.

As for apps and speaking only about google chrome, I believe this is possible but have not tested it myself, but in this case when you install the app, you are giving permissions to read cookies.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.