You could do some kind of xss. Depending on your website configuration if you set your cookies for all subdomains you could add a new subdomain let’s call it xss.example.com where you read the cookies and put them in GET args pointing back to an URL which is caught by your app.
solved How to get cookies while browing from the android mobile programmatically? [closed]