I have been told that when the browser changes, the cookie will also change. If a user uses same machine, same IP, but different browser, is there any case that the cookie could stay the same? Or it's more likely that the cookie got stolen and the attacker simply pretend to use the same cookie, same IP?
Browser cookies contain only what the server sends to your browser.
If the server can tell that you're the same user using multiple browsers, then the server can send the same cookies to each of your browsers.
I suspect that you're asking about session cookies. Most well configured servers will send a completely unique session ID each time a new session is started, and browsers will delete session cookies when they are closed.
There is no technical requirement that a server send a unique session ID in its cookies; nothing except decent security, reasonable session handling defaults on the web-platform's part, and common sense enforces this behavior on the server.