evil origin (port 8000)

Step 1. Tap the button and grant the NFC permission prompt.

Step 2. After granting, tap the link below to navigate to a different origin in the same tab. This page will be placed in the BackForwardCache (the patched renderer deliberately does not register the kWebNfc sticky feature, and the browser allow-lists kWebNfc for BFCache anyway).

Go to bank origin →

Once on the bank page, the patched renderer (simulating a compromised renderer) will send BrowserInterfaceBroker.GetInterface(device.mojom.NFC) + SetClient + Watch from this cached frame. Watch adb logcat for the NFC-BFCACHE-POC markers and then tap a physical NFC tag.