POC: EventRouter listener_url spoof → DispatchEventToURL bypass

This page is served from . The patched renderer (simulating renderer RCE) sends mojom::EventRouter::AddListenerForMainThread with listener_url = chrome-untrusted://terminal/ for sockets.tcp.onReceive and fileSystemProvider.onReadFileRequested.

On ChromeOS, the real Terminal app's SSH socket data and SFTP file-system requests are dispatched via EventRouter::DispatchEventToURL("chrome-untrusted://terminal/", ...). The browser process compares the trusted restrict_to_url against the renderer-supplied listener_url and dispatches the event to this http:// renderer.

See the Chrome stderr log for [POC-BROWSER] / [POC-RENDERER] lines proving the bypass.