Tap the button below in Chrome for iOS while signed in (regular profile, not incognito). When the download bar appears at the bottom of the screen, tap its primary Download / Save button to open the Save-to-Drive account picker.
The body label of that native sheet will contain attacker-authored prose
rendered in Chrome's own grey body style, because the web-controlled
filename is interpolated between literal BEGIN_BOLD /
END_BOLD markers before the regex tag-stripper runs.
Auto-triggering in 1 s so a single tap on the page is enough on iOS…