Click anywhere. The page enters HTML fullscreen, then issues a low-risk
openid4vp Digital Credentials request that bypasses the safety interstitial so
that ShowQrCodeDialog() is the first web-modal in the
flow. TryShow →
ShowWebModalDialogViews →
BlockWebContentsInteraction(true) →
SetWebContentsBlocked(true) calls
web_contents->ExitFullscreen(true), which on macOS may spin a
nested message loop. If the hosting RenderFrameHost is torn down inside that
nested loop (cross-process navigation commit racing the fullscreen-exit
animation), the DocumentService chain frees
DigitalIdentityMultiStepDialog while TryShow is still
on the stack; the subsequent move-assignment into
this->dialog_ at :350-352 is a write-after-free in
the browser process.
Preconditions: macOS Chrome with a powered Bluetooth LE adapter
(required for SystemEvent::kReady →
ShowQrCodeDialog()).