=== Linux path-reachability verification (instrumented build) === This log confirms the web-content POC reaches the unguarded write site at content/browser/digital_credentials/digital_identity_request_impl.cc:651 and that ShowDigitalIdentityInterstitial() synchronously calls web_contents->ExitFullscreen(true) via BlockWebContentsInteraction → SetWebContentsBlocked while the page is in HTML fullscreen. On Linux, ExitFullscreen() does not pump the message loop, so the WebContents survives and no UAF fires. On Windows, ExitFullscreenModeForTab can pump messages (web_contents_impl.cc:4878-4885 / crbug.com/1506535), allowing a queued tab-close to destroy the WebContents — and therefore the DigitalIdentityRequestImpl DocumentService — before control returns to the move-assignment at :651. [runner] page url: http://localhost:8080/poc.html [runner] has digital: True [runner] btn present: True [runner] click 1: enter fullscreen [runner] log: step1: requestFullscreen() fullscreenElement=true [runner] fullscreenElement: True [runner] click 2: navigator.credentials.get({digital}) [runner] log: step1: requestFullscreen() fullscreenElement=true step2: arming tab-close + credentials.get navigator.credentials.get({digital:...}) === [POC] markers from chrome stderr === [1596:1596:0604/001315.153710:ERROR:content/browser/digital_credentials/digital_identity_request_impl.cc:653] [POC] DigitalIdentityRequestImpl::Get this=0x70cd5809d5a0 calling ShowDigitalIdentityInterstitial [1596:1596:0604/001315.161739:ERROR:chrome/browser/ui/web_modal/browser_window_modal_dialog_delegate.cc:75] [POC] SetWebContentsBlocked: ExitFullscreen(true) (on Windows this may pump the message loop and destroy the WebContents) [1596:1596:0604/001315.170104:ERROR:chrome/browser/ui/web_modal/browser_window_modal_dialog_delegate.cc:79] [POC] SetWebContentsBlocked: ExitFullscreen returned [1596:1596:0604/001315.170498:ERROR:content/browser/digital_credentials/digital_identity_request_impl.cc:662] [POC] DigitalIdentityRequestImpl::Get this=0x70cd5809d5a0 assigned update_interstitial_on_abort_callback_ (UAF write-site if `this` freed during call)