attacker.example

1. Click the puzzle-piece toolbar button to open the Extensions menu.

2. Reach for the site-access toggle next to "Attacker Extension".

3. This page navigates to the victim origin on blur (and as a fallback ~1.2 s after load). If the navigation commits between the bubble's last paint and your click, the persistent host permission is written for the victim origin instead of this one.