Target: Chrome on Windows where WGC window capture is unavailable
(Win10 <1903, LTSC 2016/2019, Server 2016/2019, or any SKU where
IsWgcSupported(kWindow) returns false). The fallback
CroppingWindowCapturerWin caches the shared window's rect
before grabbing the full screen, then crops at that stale rect
without ever comparing it to the post-grab live rect.
Place a victim window (any other application — e.g. a text
editor showing "SECRET") at the configured position A below.
Click [1] Open popup. A solid-magenta popup P opens at A, covering
the victim.
Click [2] Share popup. In the picker, choose the
Window tab and select the popup titled
ATTACKER-POPUP-SHARE-ME.
As soon as the share is accepted, this page yanks P away to position B
(first frame: lazy DXGI init lives between rect-cache and pixel-grab),
then oscillates A↔B every ~33 ms.
Frames whose mean colour deviates from magenta are flagged as
LEAK — those frames contain the victim's pixels under the
vacated rect A.
Position A (over victim):
x
y
Position B (empty desktop):
x
y
Size:
w
h