As per my understanding, if a cookie doesn't have a domain attribute (explicitly telling where this cookie can be used), by default that cookie will be used by the domain which issued it and all its subdomain, but the parent domain of the domain which issued the cookie can't use it.
foo.example issued a cookie, it can be used by the subdomain
bar.foo.example.com but not it's parent domain i.e.
Now, suppose I found an XSS vulnerability on
foo.example.com and I want to get the cookies of
example.com. By any means is that possible? Since by default cookies issued by a subdomain can not be used by it's parent domain, I am not able to figure out any way.