Method 1 — contentType injection (real blob)

TAP: contentType injection

Method 2 — blobUrl injection (crafted blob: prefix)

TAP: blobUrl injection (may not trigger onDownloadStart)