ACTION-567

Under the browser's Same Origin policy, separately displayed webpages from
the same origin can freely read and modify each other's state. A webpage's
origin is comprised of the scheme, host and port of the URL used to
retrieve the webpage. The origin does not take into account any attributes
of the TLS session or server certificate used when retrieving a webpage.
For example, consider a user agent that has loaded two webpages from
https://www.example.com/. When the first page was retrieved, an Augmented
Assurance Certificate (AAC) was used by the TLS session. When the second
page was retrieved, a different certificate, such as a domain validated or
self-signed certificate, was used. Though the first page was retrieved
using an AAC certificate, the second page can freely read and write the
first page. Differing security presentations of the two pages may obscure
this relationship in the mind of the user.

extend section 8.6 "Mixing Augmented Assurance and Validated Certificates" with the following paragraph: