Geolocation revocation bypass via about:blank popup