Expected: within ~2s, VIYUH BDR shows an in-page banner — "near-invisible overlay frame that could hijack your clicks". Service-worker console logs DETECTION [medium] clickjacking-frame.
Precision: only a cross-origin invisible overlay fires. The same trick with a same-origin / about:blank frame, or a chat / CAPTCHA / cookie-consent widget, stays silent by design.