Don't allow GuestView JS objects to inherit global prototype.

extensions/renderer/resources/guest_view/guest_view.js

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This module implements a wrapper for a guestview that manages its
 // creation, attaching, and destruction.
 
 var CreateEvent = require('guestViewEvents').CreateEvent;
 var EventBindings = require('event_bindings');
 var GuestViewInternal =
@@ skipping 27 matching lines @@
   this.actionQueue = [];
   this.contentWindow = null;
   this.guestView = guestView;
   this.pendingAction = null;
   this.viewType = viewType;
   this.internalInstanceId = 0;
 
   this.setupOnResize();
 }
 
+// Prevent GuestViewImpl inadvertently inheriting code from the global Object,
+// allowing a pathway for executing unintended user code execution.
+GuestViewImpl.prototype.__proto__ = null;
+
 // Possible states.
 GuestViewImpl.GuestState = {
   GUEST_STATE_START: 0,
   GUEST_STATE_CREATED: 1,
   GUEST_STATE_ATTACHED: 2
 };
 
 // Sets up the onResize property on the GuestView.
 GuestViewImpl.prototype.setupOnResize = function() {
   $Object.defineProperty(this.guestView, PROPERTY_ON_RESIZE, {
@@ skipping 288 matching lines @@
 // Returns the ID for this guestview.
 GuestView.prototype.getId = function() {
   var internal = privates(this).internal;
   return internal.id;
 };
 
 // Exports
 exports.$set('GuestView', GuestView);
 exports.$set('GuestViewImpl', GuestViewImpl);
 exports.$set('ResizeEvent', ResizeEvent);