AdsBlockedDialog UAF - Stage 2 (Attacker tab)

This page must be served from an origin that Safe Browsing flags for abusive ads so that Chrome's subresource filter activates and shows the "Ads blocked" message. In a lab setup, force activation via: chrome://flags/#enable-subresource-filter and the testing ruleset, or add this origin to the local Safe Browsing list.

1. Wait for the "Ads blocked" message to appear at the bottom.
2. Tap the gear / "Details" secondary action on the message.
3. In the dialog, tap Learn more. A new support tab opens and reprompt_required_ is set to true.
4. Switch back to this tab. OnWebContentsFocused fires, which posts the dialog-show Runnable to the UI Handler.
5. The visibilitychange handler below calls window.close() synchronously. The WebContents (and the native AdsBlockedDialog) are destroyed while the Runnable is still queued.
6. The Runnable runs and shows the dialog over whatever tab is now active. Tap Always allow. The Java side calls onAllowAdsClicked(mNativeDialog) on freed memory → UAF in the browser process.