This page (1) requests a geolocation permission to make the browser show a
permission prompt bubble anchored at the omnibox, then (2) triggers the
compromised-renderer injection (via a scroll event) which sends a
PasswordGenerationDriver.ShowPasswordEditingPopup Mojo IPC with
attacker-controlled bounds positioned under the permission bubble.