The subdomain that could set your session
The session cookie is set with Secure, HttpOnly, SameSite=Lax and Domain=bank.example — careful work, by anyone's standard.
Then a marketing subdomain with a dangling DNS record gets taken over. Cookies have no origin integrity: any host under bank.example can set a cookie for the parent domain, and the app receives it with no way to tell which host wrote it. SameSite never engages, because the attacker's subdomain is same-site.
Boundaries, outermost first: bank.example · registrable domain: app.bank.example (the real app), promo.bank.example (taken over; FAILED: hijacked) Outside every boundary: Cookie jar (in the browser), an empty slot for the the cookie name Connections: app.bank.example calls the cookie name — Set-Cookie (step 1) the cookie name calls Cookie jar (step 2) promo.bank.example must NOT reach Cookie jar — rejected: __Host- forbids Domain