In a real attack, this page embeds a third-party iframe from
idp.test whose document.requestStorageAccess() call is
denied; the Storage Access omnibox indicator appears; the user clicks it and
toggles the row for idp.test to ALLOW (without pressing Done).
For this POC, the patch in chromium-changes.patch performs those
two purely-UI actions automatically — nothing in the vulnerable
CommitChanges() path is altered.
While the bubble is still open showing “victim.test” in its
subtitle, an attacker (unsandboxed ad iframe / XSS / compromised renderer)
navigates the top frame to evil.test: