Note: This form submits to https://malicious-attacker.example.com (simulated cross-origin)