The bubble's PrimaryPageChanged observer fires here, posts an
async CloseNow, and WindowClosing →
CommitChanges() live-reads web_contents()->GetURL()
— which is now this page. The 30-day STORAGE_ACCESS ALLOW grant is
written for (idp.test, evil.test) instead of
(idp.test, victim.test).