CCT openInAppOrChromeFromCct bypass POC

This page must be loaded inside a Chrome Custom Tab / Auth Tab / TWA on Android with kNavigationCaptureRefactorAndroid enabled, using a Chrome build that has the renderer-injection patch applied.

Setting document.title triggers the patched renderer to send a crafted FrameHost::OpenURL IPC with disposition=NEW_BACKGROUND_TAB and the target URL below — simulating a compromised renderer. No user interaction is required.