Attacker page (compromised renderer simulation)

This page is served from http://127.0.0.1:9876/. The victim extension has no host permission for this origin and no content script matching this URL.

The patched renderer detects ?poc-spoof-watched-page=1 in the URL and (a) sends a spoofed extensions::mojom::LocalFrameHost::WatchedPageChange IPC claiming .poc-victim-selector matched, then (b) sends OpenChannelToExtension claiming to be a content script of the victim extension.

Note: this page deliberately does NOT contain any element matching .poc-victim-selector, so a non-compromised renderer would never report a match.