The browser enforces things at two different granularities, and the bigger one keeps quietly undermining the smaller. The Same-Origin Policy knows about origins — the triple <scheme, host, port> — and a script on evil.com simply cannot touch bank.com’s DOM. But plenty of security mechanisms — the cookie Domain attribute, CORS, CSP, and postMessage trust checks — reason about the larger site, defined as the registrable domain (eTLD+1). The moment the attacker can run a subdomain under the victim’s registrable domain, they sit inside the larger ring while still outside the smaller one.
The consequence is concrete and ugly. A subdomain takeover puts the attacker on evil.bank.com, the same registrable domain as bank.com. They can now toss a Domain=bank.com cookie that shadows the victim’s session cookie, because cookies use the site ring. They can fix a session id by planting the same domain cookie. They can defeat a double-submit CSRF defence, which assumes the attacker cannot set a cookie for bank.com — an assumption true only across origins, false across the same site. They can hit a CORS endpoint that trusts *.bank.com by Origin, or a postMessage handler that whitelists by event.origin’s site. Each defence was sold by origin reasoning, but each is checked at site granularity, and site is wider.
The deeper point is that the two rings were never meant to be the same thing. Origins exist to be a hard isolation boundary that an attacker cannot cross without a bug. Sites exist to group things that share a controlling entity — the registrant of tuwien.ac.at is trusted across all its subdomains. The seam is the assumption “the registrant is benign and is the only one who can plant subdomains”. That assumption is exactly what a subdomain takeover breaks: a forgotten DNS record, an expired cloud-bucket pointed at the attacker, a vulnerable satellite service, and the attacker is now the registrant for safety purposes.
The corrected mental model: an origin boundary keeps a script out, but a site boundary declares trust, and a takeover converts “I am not trusted” into “I am trusted” without crossing either line. Defences that run their check at site granularity must assume the subdomain space is whole — and the moment it is not, the seam between origin and site becomes the entire attack surface.