[server] listening on https://0.0.0.0:8443
[REPORT] tag=normal window.credentialless=false storage-access state=granted
[REPORT] tag=credentialless window.credentialless=true storage-access state=granted

========== RESULTS ==========
  normal         window.credentialless=false state=granted
  credentialless window.credentialless=true  state=granted

[+] VULNERABILITY CONFIRMED:
    The credentialless (nonce-partitioned) iframe observed state='granted' for
    navigator.permissions.query({name:'storage-access'}), leaking the profile-wide
    STORAGE_ACCESS(embed.test, top.test) grant across the partition boundary.
    Expected per credentialless threat model: 'prompt'.

Chrome log tail (CONSOLE lines):
[2760:2760:0530/211118.735640:INFO:CONSOLE:18] "[embed.test normal] window.credentialless=false permissions.query(storage-access).state=granted ", source: https://embed.test:8443/embed.html (18)
[2760:2760:0530/211118.747328:INFO:CONSOLE:18] "[embed.test credentialless] window.credentialless=true permissions.query(storage-access).state=granted ", source: https://embed.test:8443/embed.html (18)