Definition
Cookie Jar Overflow
A browser stores only a bounded number of cookies per site (around 180). When the limit is reached, older cookies are evicted. A same-site attacker who can set cookies — for instance by repeatedly visiting the apex domain through a subdomain takeover — can flood the jar so that the victim’s existing cookies are evicted.
This can drop
HttpOnlycookies (evicting the victim’s session), or strip a__Host-cookie and re-open the door to tossing. The attack works becauseHttpOnlyprotects cookie confidentiality against JavaScript, but provides no integrity against eviction.