HEIST: HTTP Encrypted Information Can Be Stolen Through TCP-Windows [pdf]

Seems to me same-site cookies would solve this problem.

https://www.owasp.org/index.php/SameSite