demo · v136

Policy Fuzzer

Build an iframe with a custom allow attribute, then fuzz it: the child tries to call every interesting permission-gated API in sequence and the parent's ReportingObserver shows which ones triggered a permissions-policy-violation.