vulns.co
/
GKData.io MCP

Back to Gadgets

Partitioned cookie gap

CHIPS is the Partitioned cookie attribute. It keys a cookie to the top-level site so an embed does not share a jar with the first-party site. Chrome still sends unpartitioned third-party cookies when the user allows them. The gap is a credential cookie sent…

Tags: cookie, session, chips, partitioned

Typical severity: P3-P5

What it becomes

Low alone while the browser blocks the cross-site send, and it becomes session confusion when an embed still receives an unpartitioned cookie or the server trusts the wrong jar.

Where to look

  • embedded widgets and payment frames
  • SSO loaded in a third-party context
  • Set-Cookie on responses that are requested cross-site

Chains

  • Cross-site session use: An embed on another site still receives the credential cookie because it is not Partitioned and the browser has not blocked that send.
  • Jar confusion: The server accepts either the Partitioned cookie or an unpartitioned cookie of the same name, so the two jars disagree and the app follows the wrong one.

Notes

  • CHIPS cookies are set with Partitioned and Secure. A missing attribute is the signal, not a bypass string.
  • Name the browser, version, and whether third-party cookies were allowed. Chrome's normal profile is not a global block. Incognito and several other browsers are.