[http] "GET /poc.html HTTP/1.1" 200 -
[http] "POST /report?tag=ready HTTP/1.1" 200 -
[http] code 404, message File not found
[http] "POST /report?tag=window-open HTTP/1.1" 200 -
[http] "POST /report?tag=before HTTP/1.1" 200 -
[http] "POST /report?tag=after HTTP/1.1" 200 -
[http] "POST /report?tag=done HTTP/1.1" 200 -
png_a.png: 73 bytes
png_b.png: 95 bytes
[server] listening on http://127.0.0.1:8080/poc.html
[driver] clipboard <- png_a.png (73 bytes)
[driver] chrome pid=1207
[server] page ready
[driver] chrome window id=4194307
[driver] sending Ctrl+V
[server] race window OPEN — swap the OS clipboard PNG now
[driver] clipboard <- png_b.png (95 bytes)
[server] received 'before' blob: 73 bytes sha256=2623c363acceb286
[server] received 'after' blob: 95 bytes sha256=67333ec71f010da7
[server] ====================================================
[server] before blob: 73 bytes
[server] after  blob: 95 bytes
[server] png_a.png : 73 bytes sha256=2623c363acceb286 (what the user pasted)
[server] png_b.png : 95 bytes sha256=67333ec71f010da7 (placed AFTER paste)
[server] VERDICT: VULNERABLE: page received png_b.png — clipboard contents placed AFTER the user's paste were disclosed to the page
[server] ====================================================

[driver] FINAL VERDICT: VULNERABLE: page received png_b.png — clipboard contents placed AFTER the user's paste were disclosed to the page

  chrome> [1207:1207:0412/174651.546776:INFO:CONSOLE:13] "[paste] fired; items=1", source: http://127.0.0.1:8080/poc.html (13)
  chrome> [1207:1207:0412/174651.547119:INFO:CONSOLE:13] "  item kind=file type=image/png", source: http://127.0.0.1:8080/poc.html (13)
  chrome> [1207:1207:0412/174651.563921:INFO:CONSOLE:13] "[paste] execCommand(copy) -> true (snapshot wiped)", source: http://127.0.0.1:8080/poc.html (13)
  chrome> [1207:1207:0412/174654.589119:INFO:CONSOLE:13] "[paste] before size=73  after size=95", source: http://127.0.0.1:8080/poc.html (13)
  chrome> [1207:1207:0412/174654.600591:INFO:CONSOLE:13] "before hash: 89504e470d0a1a0a0000000d494844520000000400000004080200000026930929000000104944415478da63f8cfc000470cc47100ae930ff1385e8c11000000", source: http://127.0.0.1:8080/poc.html (13)
  chrome> [1207:1207:0412/174654.600763:INFO:CONSOLE:13] "after  hash: 89504e470d0a1a0a0000000d4948445200000020000000200802000000fc18eda3000000264944415478daedcdb109000008c0b0feffb45ee12004b2a79a6302", source: http://127.0.0.1:8080/poc.html (13)
  chrome> [1207:1207:0412/174654.601040:INFO:CONSOLE:13] "*** VULNERABLE: getAsFile() returned a DIFFERENT PNG than the user pasted ***", source: http://127.0.0.1:8080/poc.html (13)