I disagree. The point in either case is to get a cookie of the attacker's choosing accepted as the session identifier for the privileged domain.

But even if we consider them separate techniques, the mitigation strategy is identical anyway.