Host this page on origin A (https://a.test/) with
Cross-Origin-Embedder-Policy: require-corp +
Cross-Origin-Opener-Policy: same-origin. Host a 100x50 PNG
(or similar) at https://b.test/animated.png with no CORP
header. Then load this page. See the header comment block for server
setup details.
Victim URL (origin B):