bank origin (port 8001)

This is a different origin. The previous page is now in the BackForwardCache.

The compromised (patched) renderer for the cached page is now binding device.mojom.NFC through its still-open BrowserInterfaceBroker pipe and calling Watch().

Tap an NFC tag now while looking at this page. Check adb logcat | grep NFC-BFCACHE-POC on the host.