[*] http server on http://127.0.0.1:8080/poc.html [*] launching chrome [POC] AudioContext state: running, sampleRate=44100 [*] waiting for __poc_ready ... [POC] baseline (visible): {"totalDuration":1.012798,"underrunEvents":0,"underrunDuration":0,"minimumLatency":0.030068,"maximumLatency":0.030068,"averageLatency":0.030068} [POC] [POC] READY. Switch to another tab for ~5 seconds, then switch back. [*] hiding POC tab for 5.0s ... [POC] --> page HIDDEN at t=2405.5ms [POC] while hidden, JS-visible stats (frozen): {"totalDuration":1.012798,"underrunEvents":0,"underrunDuration":0,"minimumLatency":0.030068,"maximumLatency":0.030068,"averageLatency":0.030068} [*] un-hiding POC tab ... [*] waiting for __poc_done ... [POC] --> page VISIBLE again; hidden for 5.113s wall-clock [POC] after unhide: {"totalDuration":7.794772,"underrunEvents":0,"underrunDuration":0,"minimumLatency":0.03,"maximumLatency":0.032879,"averageLatency":0.03133} [POC] [POC] === RESULT === [POC] wall-clock hidden interval : 5.113 s [POC] totalDuration delta (incl. hidden) : 6.782 s [POC] underrunEvents delta : 0 [POC] underrunDuration delta : 0.000000 s [POC] latency over interval [min/avg/max]: 0.030000 / 0.031330 / 0.032879 s [POC] expected delta if hidden data were DISCARDED : ~1.5 s (settle window only) [POC] expected delta if hidden data were RELEASED : ~6.6 s [POC] VERDICT: VULNERABLE -- hidden-period playout stats (~5.1s worth) were released wholesale on first visible Absorb(). Visibility gate provides no suppression. [+] DONE — verdict: VULNERABLE