// GLOSSARY

Related-domain Attacker

The attacker position that controls a subdomain sharing the victim's registrable domain (eTLD+1). It is often overlooked in threat modeling, because it is neither a full outside attacker nor a trusted inside actor; it stands in a gray zone the browser security model leaves at exactly this in-between position. Most browser protections operate at the origin or site scope, and two subdomains sharing the same eTLD+1 are usually counted within the same 'site'; so an attacker in this position is born inside certain trust boundaries a full stranger could not cross. This in-between position gives it privileged ground: techniques such as cookie tossing, cookie shadowing and session manipulation operate exactly over this shared boundary. How is such a position obtained? Often not by seizing the main application but a more weakly protected subdomain around it; a forgotten marketing page, a test environment or a lapsed subdomain takeover. In multi-subdomain architectures, therefore, boundary security depends on the integrity not only of the main application but of the whole subdomain family; the __Host- prefix is the most robust control against this threat.