Attacker page (origin A = )

Embedded cross-origin payment iframe (origin M):

Attacker's exfiltration sink (would be display:none in a real attack; shown here so you can see the leaked data)



Step 1: Click the card-number field in the merchant iframe so the Autofill popup with your stored card appears.
Step 2: Wait for the "spoofed kAtMemory IPC sent" message below (fires every 2 s once you press the button).
Step 3: Click your card in the (still-visible) popup.
Step 4: Observe the full card number / CVC populate in the ATTACKER fields above, while the merchant iframe stays empty.