Help me understand the cost/benefit. What conditions enable attackers to write cookies for a domain?
One interesting scenario is HTTP vs HTTPS cookies. With an HTTPS site, man-in-the-middle attacks are not normally possible. However, if the user requests an HTTP site, a MITM attacker can tamper with the communication, include an iframe reference to the domain they want to target, and within the iframe write to cookies. Although this communication is over HTTP, cookies set here affect the HTTPS cookie store. I wrote about this some years ago.