[
    {
        "href": "http://localhost:8080/",
        "origin": "http://localhost:8080",
        "isSecureContext": true,
        "sandboxed": false,
        "geolocation_state": "granted",
        "notifications_state": "granted",
        "verdict": "Control page (not sandboxed). Permission state: granted. Now navigate to /sandboxed to see the bypass."
    },
    {
        "href": "http://localhost:8080/sandboxed",
        "origin": "null",
        "isSecureContext": true,
        "sandboxed": true,
        "geolocation_state": "granted",
        "notifications_state": "granted",
        "verdict": "*** BUG CONFIRMED ***  origin is \"null\" (opaque) but geolocation permission state is \"granted\". The CSP sandbox boundary has been bypassed: this opaque-origin document is reusing the permission grant for localhost:8080."
    }
]