HTML Embed Test - payload delivered via inline script