After ? ms this page sets
document.title = "POC_FIRE_DRAG", which the injected
renderer code interprets as the trigger for a malicious
LocalFrameHost::StartDragging IPC carrying a
javascript: uri-list and a kMouse source whose
location is the centre of this widget — exactly what a renderer with
arbitrary code execution can send at any time.