I mean, with "document.cookies" the browser shows cookie(s) that belong(s) to only for that website. (Or doesn't it?) So, could an XSS attack steal all stored cookies in device/browser? Thanks.
with "document.cookies" the browser shows cookie(s) that belong(s) to only for that website.
This statement is not entirely true. The
That depends on the type of XSS. An XSS vuln in a web site can only be used to steal non-HTTPOnly cookies on the domain in question (and possibly subdomains if they have set domain to the root domain in any of their cookies). If however you manage to exploit an XSS in a chrome extension (or some other type of universal XSS), you may be able to steal cookies for all pages including HTTPOnly cookies.
When you use a browser, the website where you are can only access to its cookies. It can't access to the cookies of others websites.
So with an XSS, you are able to stole all stored cookies from the website which is vulnerable. This is not a restriction of document.cookie but a restriction of your browser. You can have a more detailed answer in this can a webpage read another pages cookies