Coordinated-disclosure demonstration. Nothing leaves this page. Deny every prompt.
1 · Environment — is this page inside Ledger Live?
URL
—
wallet-api bridge (window.ElectronWebview)
—
Electron host hints (window.api)
—
User-Agent
—
2 · Consent-gated bridge probe — click to fire account.list and observe which Ledger consent UI appears. Deny it — the point is the modal exists, not the data.
3 · Origin-blind navigation — /ledger-demo/hop.html 302-hops to a second origin. If the webview follows it, will-redirect has no origin check (finding B3).