"..leapfrogged between the accounts ... by inserting various account numbers into a string of text located in the browser’s address bar ... wondered how the hac

"..leapfrogged between the accounts ... by inserting various account numbers into a string of text located in the browser’s address bar ... wondered how the hackers could have known to breach security by focusing on the vulnerability in the browser." ...so they put forgeable account numbers/cookies in the URL, and then acted surprised when someone changed them for profit?