More importantly, user content can read and write cookies from the subdomain to the parent domain.