victim.example (top-level)

WebView host app has called CookieManager.setAcceptThirdPartyCookies(webview, false).