Nah cookies are specifically separated out per-domain. There are some awful companies which do set cross-website cookies (e.g. facebook, google, and other adware), but (1) they do not leak your credentials and are used mostly for fingerprinting and ad targeting, (2) should be filtered out by your browser’s tracking protection (hence “if your browser is set up correctly”). Realistically there would still be a way for the website to fingerprint you enough to know who you are, so the most adversarial outcome from clicking a link is that the attacker can know that you clicked that link, along with your general location (from geoIP) and some device info. iirc that’s how the linux tech tips channel got into trouble. Nah, that was pretty much an .exe sent out by a fake sponsor, which then stole browser data (including login cookies). Opening a link ≠ running an unsandboxed exe.