samesite cookies

A subtle bug in how Firefox and Thunderbird handled cross-site navigations inside nested iframes allowed browsers to incorrectly include SameSite=Strict or SameSite=Lax cookies in situations where they should have been withheld, creating a window for cookie leakage and session abuse. The issue...