==============================================================================
POC RUN (./run.sh) — malicious extension with sandbox\u000ballow-same-origin
==============================================================================
[455:455:0527/153306.408540:INFO:CONSOLE:23] "[CSP-VT-POC] window.origin="chrome-extension://chkhegdnmbhmcbelbldbpibnhinjjlpa" location=chrome-extension://chkhegdnmbhmcbelbldbpibnhinjjlpa/sandboxed.html verdict=VULNERABLE: sandbox allow-same-origin smuggled past validator", source: chrome-extension://chkhegdnmbhmcbelbldbpibnhinjjlpa/sandboxed.html (23)

[+] BYPASS CONFIRMED: sandboxed page committed with non-opaque chrome-extension:// origin.

==============================================================================
CONTROL RUN (./run.sh ./control-extension) — legitimate `sandbox allow-scripts`
==============================================================================
[276:276:0527/153236.353436:INFO:CONSOLE:13] "[CSP-VT-CONTROL] window.origin="null" opaque=true (expected: opaque=true for a correctly sandboxed page)", source: chrome-extension://dmmpjpeikhecpobbaaefdegpcbnfnbln/sandboxed.html (13)

==============================================================================
POST-FIX RUN (bandaid-fix.patch applied) — manifest now rejected at load time
==============================================================================
[1170:1170:0527/153537.883813:WARNING:extensions/browser/load_error_reporter.cc:73] Extension error: Failed to load extension from: /poc-artifacts/extension. Invalid value for 'content_security_policy.sandbox'.