Precondition: the GPU/Viz process is compromised and sends a viz.mojom.CopyOutputResult whose BitmapInSharedMemory.row_bytes is larger than width*4. In this POC the compromise is simulated by chromeos-gpu-injection.patch, which modifies the GPU-side serializer to emit an inflated row_bytes on the wire.