attacker.example (main frame)

Step 1. Tap inside the red iframe below, on the misspelled word mispeld. This focuses the cross-origin OOPIF and places the caret on a spell-checked word.

Step 2. Tap this button. The attacker frame will call StartSuggestionMenuTimer() (browser binds its cached TextSuggestionBackend Remote to the focused victim OOPIF), wait for the timer to fire, then call ShowSpellCheckSuggestionMenu() with an attacker-controlled string.

Step 3. A native Android suggestion popup appears containing ATTACKER_PAYLOAD. Tap it.

Expected result: the victim iframe's input field text is replaced with ATTACKER_PAYLOAD — cross-origin text injection via the browser process.