If somebody injects JS into your stream, you are most likely screwed, but it doesn't mean your cookies can be stolen. Cookies can be set to HttpOnly (and should be, if you're trying to operate a secure site).
You're in luck! I have a Chrome extension that prevents just that. Let me send you a copy you can install for yourself...
+Secure flag to block sending the cookies over plain HTTP.
I am guessing that they are able to bypass this restriction.
No, the attack is against SSL and Man-in-the-Middle. They just make the browser send SSL requests with those cookies, and then guess the cookie (sent inside the SSL session).