That has no relation to the use of CNAMEs—this problem exists even if CNAME records aren’t used. If “z” is a public suffix, x.y.z can set and read cookies from

That has no relation to the use of CNAMEs—this problem exists even if CNAME records aren’t used. If “z” is a public suffix, x.y.z can set and read cookies from x.y.z and y.z, but not z. Whether this is possible has nothing to do with whether x.y.z is a CNAME.