CVE-2026-13323 VARIANT PoC (HTML-as-icon)

This HTML file is smuggled as the extension icon and served from the registry origin.