Attacker

This page creates ~5000 DOM elements so that Blink assigns AXNodeIDs in the range [1, 5000]. When this tab is backgrounded on Android with an accessibility service active, PaintPreviewTabService captures an AXTreeSnapshot containing these IDs. When the snapshot is later replayed via PlayerManager → WebContentsAccessibilityImpl.initWithAXTree, every snapshot node registers in the process-global GetUniqueIdMap() at its raw Blink AXNodeID, overwriting any live-tree node from another tab that was assigned the same value by AXUniqueId::Create().