Hidden Passenger? How Taboola Routes Logged-In Banking Sessions to Temu

**Executive Summary:** A Taboola pixel embedded on authenticated banking pages performed a 302 redirect to a Temu tracking endpoint with Access-Control-Allow-Credentials, allowing cross-origin cookies and enabling Temu to associate logged-in bank sessions with tracking identifiers without user consent; traditional defenses missed this runtime redirect, creating broad privacy and regulatory risk under GDPR and PCI.