Don't allow GuestView JS objects to inherit global prototype.

extensions/renderer/resources/guest_view/guest_view.js

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This module implements a wrapper for a guestview that manages its
 // creation, attaching, and destruction.
 
 var CreateEvent = require('guestViewEvents').CreateEvent;
 var EventBindings = require('event_bindings');
 var GuestViewInternal =
@@ skipping 27 matching lines @@
   this.actionQueue = [];
   this.contentWindow = null;
   this.guestView = guestView;
   this.pendingAction = null;
   this.viewType = viewType;
   this.internalInstanceId = 0;
 
   this.setupOnResize();
 }
 
+// Prevent GuestViewImpl inadvertently inheriting code from the global Object,
+// allowing a pathway for executing unintended user code execution.
+GuestViewImpl.prototype.__proto__ = null;

[lazyboy, 2017/02/24 22:27:57]

A better solution is to use utils.expose() which already does this I think. We
should audit all of guest_view's exposed properties and make sure this kind of
unintended behavior isn't possible to (or at least not straightforward to)
abuse.

It'd be great if you can consider fixing that in subsequent patch(es).

+
 // Possible states.
 GuestViewImpl.GuestState = {
   GUEST_STATE_START: 0,
   GUEST_STATE_CREATED: 1,
   GUEST_STATE_ATTACHED: 2
 };
 
 // Sets up the onResize property on the GuestView.
 GuestViewImpl.prototype.setupOnResize = function() {
   $Object.defineProperty(this.guestView, PROPERTY_ON_RESIZE, {
@@ skipping 288 matching lines @@
 // Returns the ID for this guestview.
 GuestView.prototype.getId = function() {
   var internal = privates(this).internal;
   return internal.id;
 };
 
 // Exports
 exports.$set('GuestView', GuestView);
 exports.$set('GuestViewImpl', GuestViewImpl);
 exports.$set('ResizeEvent', ResizeEvent);