Bypass using object with no contentWindow #96
Description
var obj = document.createElement('object');
Object.defineProperty(obj, 'contentWindow', { value: null });
document.body.appendChild(obj);
obj.data = '/';
obj.contentDocument.defaultView.alert(1);
Basically workaround chromium_bug_workaround.js :) should be easy to fix using this