The SAME TAB visits a trusted service (Drive/Docs/SharePoint/Dropbox/cloud-storage) then a phishing terminus → WARN. Test it with a same-tab navigation; the realistic version is a "shared doc on trusted storage" that links out.
PASS 0 · FAIL 0 / 0
Extension v0.8.7+ reloaded · keep chrome://extensions → VIYUH BDR → service worker open. POS must detect; NEG/FP must stay silent; LIVE = real-host steps.