All harness pages

Hostile sibling frame

This allowed parent embeds the chat widget and a frame from a different origin (engagr-widget-hostile-test.pages.dev). The hostile frame repeatedly posts forged engagr:campaignContext (consent granted, hostile UTM/click IDs) into every sibling frame and into this page. Default parent consent is denied; add ?consent=granted&utm_source=harness-parent to prove hostile values cannot replace the real parent's attribution either.

loading…