In more detail
The owner of example.com can create any number of subdomains with DNS records at no extra cost, to separate a blog, an app or a staging site. Browsers treat each subdomain as a different site for most security rules, but cookies set for the parent domain are shared with all of them. Unused subdomains with leftover DNS records can be hijacked.