iOS AccountConsistencyHandler initiator-origin bypass

On Chrome for iOS with a signed-in user, this non-Google page can force native sign-in UI / an incognito tab to open by navigating (top-level or in a subframe) to an accounts.google.com endpoint that returns the X-Chrome-Manage-Accounts header. AccountConsistencyHandler::ShouldAllowResponse acts on the header without checking the request initiator or response_info.for_main_frame.

Top-level navigation variants:





Subframe variant (also fires — for_main_frame is ignored):