Initial same-origin subframe. The extension HAS host permission for this URL. After userScripts.execute() validates this frame, it will be navigated to victim.test cross-origin during the async file-load window.