Windows SC_MOVE / SC_SIZE → ::DoDragDrop hijack

This page simulates a compromised renderer. The patched renderer (chromium-changes.patch) hooks window.status so that setting it to "POC_FIRE" sends an unsolicited LocalFrameHost::StartDragging Mojo IPC to the browser process with attacker-chosen drag data (javascript:alert(document.domain+'-pwned') + plain text).

1. Load this page in the active tab of a Chrome window on Windows.
2. Show the bookmarks bar (Ctrl+Shift+B) to give yourself an obvious drop target.
3. Grab the window's titlebar with the left mouse button and start moving the window (or grab a resize border).
4. The browser UI thread enters DefWindowProc(WM_SYSCOMMAND, SC_MOVE) with ScopedAllowApplicationTasksInNativeNestedLoop in scope and g_is_dragging == false. One of this page's StartDragging IPCs is dispatched inside that modal loop.
5. DesktopDragDropClientWin::StartDragAndDrop's CHECK(!g_is_dragging) passes and ::DoDragDrop runs while your left button is still held on the titlebar.
6. The window stops moving (DoDragDrop steals capture). Keep moving the mouse over the bookmarks bar / another tab / Explorer and release: the attacker payload is dropped there.

IPC fired: 0