Yes, it does, since apps are sandboxed better than web pages. There are a number of steps you can take depending on your browser: Disabling 3rd-party cookies prevents this attack. So does Firefox's Containers (or just private browsing) and other addons like uMatrix.