Don't allow GuestView JS objects to inherit global prototype.

extensions/renderer/resources/guest_view/guest_view.js

Index: extensions/renderer/resources/guest_view/guest_view.js
diff --git a/extensions/renderer/resources/guest_view/guest_view.js b/extensions/renderer/resources/guest_view/guest_view.js
index 1f887a746b3572e23d2a7818d236c1f91422070f..939a0b18afcbb554969059aff812ff9e611beebb 100644
--- a/extensions/renderer/resources/guest_view/guest_view.js
+++ b/extensions/renderer/resources/guest_view/guest_view.js
@@ -45,6 +45,10 @@ function GuestViewImpl(guestView, viewType, guestInstanceId) {
   this.setupOnResize();
 }
 
+// Prevent GuestViewImpl inadvertently inheriting code from the global Object,
+// allowing a pathway for executing unintended user code execution.
+GuestViewImpl.prototype.__proto__ = null;

[lazyboy, 2017/02/24 22:27:57]

A better solution is to use utils.expose() which already does this I think. We
should audit all of guest_view's exposed properties and make sure this kind of
unintended behavior isn't possible to (or at least not straightforward to)
abuse.

It'd be great if you can consider fixing that in subsequent patch(es).

+
 // Possible states.
 GuestViewImpl.GuestState = {
   GUEST_STATE_START: 0,