This page creates an initial-empty-document subframe, then navigates the top level cross-origin to victim.com so this page enters the back/forward cache. The compromised-renderer simulation (patched into content/renderer/render_frame_impl.cc) then sends a forged DidCommitProvisionalLoad from the BFCached subframe to the browser.