b.test (attacker-controlled, served with CSP: frame-src 'none')

Creating grandchild iframe to http://a.test:18080/blocked ...