Hacker News Reader

Not in any way a web dev, but couldn't an XSS on Lenovo's site make it possible to leak these?

> an XSS on Lenovo's site make it possible to leak these?

Not if they're HttpOnly cookies. Then it requires actually compromise/mitm of the application server code to recover the cookies.