It's not any worse than third party scripts, which give you full access to the DOM.
Session tokens should be stored in an httpOnly cookie, so they're not accessible to a third party script.
CNAMEs could absolutely lead to leaked session tokens, but website owners should already be somewhat accustomed to hiding cookies away from third party subdomains. These days, lots of third party services run on subdomains... blogs, status pages, email click trackers, support desks, etc.
You can't steal cookies, but you can perform actions as the user, eg.
$.post("/api/transfer_funds", {"recipient": "attacker", "amount": 999999})