Your app runs on https://app.example.com with a SameSite=Lax session cookie. An attacker controls https://blog.example.com, where users can post content. Does SameSite stop CSRF from the blog?

A site is the scheme plus the registrable domain, here https://example.com. So blog.example.com and app.example.com are same-site, even though they are different origins. SameSite only looks at the site, so it sends the cookie. Fixes: CSRF tokens, rejecting requests whose Sec-Fetch-Site header isn't same-origin, and serving user content from a separate domain, like GitHub's githubusercontent.com.

"Different subdomains are always cross-site" is the tempting wrong answer. It mixes up site and origin. "Lax cookies are sent on every request" is wrong. Lax holds them back on cross-site subrequests and POSTs.