The widget embedded on a thousand sites
A support-chat widget runs in an iframe across hundreds of customer sites and keeps its session in a third-party cookie. It stopped working in Safari and Firefox, which block those by default — and the security team points out that one shared cookie lets the vendor follow a single person from site to site.
Both complaints have the same root: one cookie jar, shared across every site the widget appears on.
Boundaries, outermost first: Top-level site A: Widget iframe (on site A), retail.example Top-level site B: Widget iframe (on site B; FAILED: blocked), news.example Outside every boundary: an empty slot for the the cookie attribute Connections: Widget iframe calls the cookie attribute — jar for site A (step 1) Widget iframe calls the cookie attribute — separate jar for site B (step 2)