Victim page — http://localhost:8081

This page is cross-site relative to the attacker (localhost vs 127.0.0.1), so under default Site Isolation it runs in a separate renderer process. After a short delay it sends a same-origin POST with a secret body and a secret header. The attacker's renderer should never see any of this — but it will, via the leaked webRequest events.