Victim main frame — origin http://localhost:8080

This is the page the developer is inspecting. It embeds a cross-origin iframe (origin http://localhost:8081) that runs in a separate renderer process. In this POC that iframe's renderer plays the role of the compromised renderer.

When DevTools auto-attaches, the frontend creates a tab session (no sessionId), a session for this frame, and a session for the cross-origin iframe — all sharing one DevToolsCDPConnection and one global #callbacks map keyed only by message id.