Chrome

Chrome console

Here is two lines to help find vulnerable postMessage calls.

Break on weak postMessage

debug(postMessage, "arguments[1] == '*'")

Log post message events

monitorEvents(windows, 'message')

Download manager

Go to about://download-internals to download a file manually.

Builtin file explorer

If you have a chromium based explorer, go to file:///C:/ to list the content of the C:.