Compromised renderer simulation.
After the victim dialog is orphaned by the window swap, this frame sends LocalFrameHost.ShowPopupMenu to rebind popup_client_ on the browser side.

Send attacker ShowPopupMenu (step 4)