There are two browsers involved, both dealing with just one site and neither in any way aware of the other. The outer browser is running on the user's machine,

There are two browsers involved, both dealing with just one site and neither in any way aware of the other. The outer browser is running on the user's machine, loading a page from the attacker's origin. That page makes no cross-site requests, but just establishes a websocket connection to the attacker's server (the data connection for the remote desktop protocol) and renders the remote desktop to the outer browser on a canvas. The inner browser is running on the attacker's server, just configured to show no URL bar or other chrome. It has loaded the genuine login page of the target site completely normally.