Not quite, they couldn't read the cookies. But they could mess with the cookies on github.com somewhat. The fully writeup is here: https://github.blog/2013-04-

Not quite, they couldn't read the cookies. But they could mess with the cookies on github.com somewhat. The fully writeup is here: https://github.blog/2013-04-09-yummy-cookies-across-domains/ https://github.blog/2013-04-09-yummy-cookies-across-domains/