I might have access to your device for as long as you have a particular web page open, and want access even after you've closed the tab. So I can escape from a

I might have access to your device for as long as you have a particular web page open, and want access even after you've closed the tab. So I can escape from a sandbox if I have a suitable exploit, or carry the cookie to a device where I'm outside the sandbox. The latter seems simpler.