victim.com (cross-origin foreground page)

When this page becomes the primary page, the BFCached evil.com renderer sends a forged subframe commit which the browser writes into THIS page's NavigationEntry tree.