idp.test (third-party iframe)

In a real attack this iframe calls document.requestStorageAccess() after a user click, gets denied, and the omnibox Storage Access indicator appears. The POC patch records that browser-side state directly (see chromium-changes.patch) so no manual click is required.