It is not about the domain scope of a cookie, but defining when should a cookie be attached to the outgoing http request. Right now when evil.com does XHR or f

It is not about the domain scope of a cookie, but defining when should a cookie be attached to the outgoing http request. Right now when evil.com does XHR or form submission to google.com, browser attaches all google.com cookies automatically. The request happpens even though response can't be read back by evil.com. With SameSite attrib on all cookies, request to google.com from evil.com won't send any cookies. This will severely limit CSRF and other types of attacks. In fact I'm surprised no one proposed this earlier. Hindsight bias of course.