Untrusted Web Guest (http://localhost:8080)

This page is loaded inside a <webview>. A compromised renderer for this origin (simulated via Strategy-B code injection keyed on the "#poc-guest-draggable-regions" fragment) sends LocalMainFrameHost::DraggableRegionsChanged({0,0,10000,10000}) over Mojo. GuestViewBase forwards it to the embedder's AppWindow with the source WebContents laundered to embedder_web_contents(), so AppWindow's CHECK_EQ passes and the entire embedder window becomes HTCAPTION.