attacker.com — Tab 1

This tab receives ImeRenderWidgetHost pipe #1. The patched renderer stashes the remote in a process-global. In 4 s this tab navigates cross-origin to victim.com, which is site-isolated and gets a new renderer process. Pipe #1's Java receiver is never closed.

Before navigating, open keepalive.html in a second tab so this renderer process survives the cross-process navigation.