Bypassing SameSite cookie protections on Chrome
How Chrome’s ‘Lax + 2 minute’ cookie intervention opened a CSRF window on ChildsMath, a math learning platform used by McMaster University students, letting an attacker silently redirect a student’s grades to an attacker-controlled email.