Here, let me show my work:
1. All these cross-origin protections the browser uses are basically entirely meaningless without SSL, because you're talking to an unathenticated counterparty. So you've got to assume site A is using SSL+HSTS before a conversation about cross-origin protection even becomes coherent. You've also got to assume that, since site A is using HSTS, site B has to attack it by running SSL as well.
2. Now, with SSL, you can't have two separate sites on the same domain unless they're mutually-trusting, because they would need to share the same cert--and thus both have copies of the private key used to generate that cert. (Unless a CA screwed up and double-issued a cert, that is.) So you have to assume the attacker is now on a separate domain (or using a self-signed cert) for the conversation about cross-origin protection to retain coherency.
3. Disallow connections to sites with self-signed certs. (Browsers already do this.)
4. Do all the cross-origin protection stuff--like not sending cookies--when the domain is different. (Browsers already do this.)
5. You're done, because the previous assumptions simplified the problem.
Your browser's SSL logic, combined with CAs' certificate-signing policies, have effectively protected you from talking to anything running on the same domain as site A, which doesn't also use the cert site A uses. Everything left is either mutually-trustworthy (that is, has access to site A's SSL private key), or has managed to break your SSL stack somewhere--in which case, we're back to the "you're screwed because you're talking to an unauthenticated counterparty" problem.
Your assumptions about what is possible in certain hypothetical situations should not cause all security opportunities to be eroded. I mean, seriously: the logical conclusion to your argument is that all non-SSL websites should just share a global pool of insecure cookies, because it isn't like any of it can be considered secure anyway. The people you are protecting yourself from matters: these attacks are different threat models, and are secured separately.