victim.example — Upload a profile photo

This page only asks for an image and does not request the camera (accept="image/*", no capture attribute).

Expected (correct) behaviour: tapping the box shows the normal file-upload context menu filtered to images.
Observed with bug: the front-facing camera opens directly, full screen, attributed to this origin.