Legitimate PWA at localhost:8080

This page is served from http://localhost:8080. In a real attack the renderer for this page would be compromised. The patch applied to manifest_parser.cc simulates that compromise: the renderer overwrites share_target.action with http://attacker-exfil.localhost:9999/steal-shared-data before sending the manifest to the browser over Mojo.

Watch the Chrome stderr log for [POC-BROWSER-MOJO] — that line is printed by the browser process after MaybeGetBadMessageStringForManifest has run, proving the cross-origin action passed the only browser-side validation.