This page is site-isolated and runs in a fresh renderer process. The browser
created ImeRenderWidgetHost pipe #2 for it. Meanwhile, the attacker's renderer
is still pumping UpdateCursorAnchorInfo over pipe #1, which the
Java ImeAdapterImpl for this WebContents still services.
Tap the field and watch adb logcat -s ImePoc chromium: