🔒 Attacker content inside the Priceline appthe attacker controls a trusted in-app WebView

📱 1. Attacker-controlled environment

origin (attacker server)...
host...
Context...
User-Agent...

🍪 2. Data access (what is exposed)

document.cookie...
localStorage...
sessionStorage...
window globals (tokens)...
If empty, cookies are protected (HttpOnly / per-origin isolation) — correct. The real impact is the native bridge + phishing below.

🌇 3. Native JavaScript bridge

window.pclnNative...
methods...
called from foreign JS...
The pclnNative bridge is injected into every loaded page — an attacker origin can call it.

🎣 4. Phishing inside the trusted app

Fake "Secure Checkout". Card data is NOT sent to Priceline — it is exfiltrated to the attacker server.
⚠️ THIS SCREEN IS RENDERED BY AN ATTACKER INSIDE THE PRICELINE APP