victim.example (top-level)

This page delegates publickey-credentials-get to a cross-origin iframe, as payment/SSO widget integrations commonly do.