This frame runs in its own renderer process (site isolation). The POC patch makes that renderer behave as if it were compromised: every time the DevTools frontend sends it a CDP command (call_id N), the renderer abuses its DevToolsSessionHost mojo remote to emit fake "responses" {"id":N±k, "result":{...}, "sessionId":<own>} for adjacent ids. Because the frontend's #callbacks map is keyed by id alone, those spoofed messages resolve callbacks belonging to other sessions (the tab session and the cross-origin parent frame session).