The getDisplayMedia picker now showing over this page was queued by http://localhost (the attacker), but is titled as if 127.0.0.1 requested it.