[kevincox]

Not quite, they couldn't read the cookies. But they could mess with the cookies on github.com somewhat.

The fully writeup is here: https://github.blog/2013-04-09-yummy-cookies-across-domains/