A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This issue is related to the incorrect SameSite attribute in a cookie file, which could allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.