Don't allow GuestView JS objects to inherit global prototype.

extensions/renderer/resources/guest_view/guest_view_container.js

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This module implements the shared functionality for different guestview
 // containers, such as web_view, app_view, etc.
 
 var DocumentNatives = requireNative('document_natives');
 var GuestView = require('guestView').GuestView;
 var GuestViewInternalNatives = requireNative('guest_view_internal');
@@ skipping 13 matching lines @@
   this.setupAttributes();
 
   privates(this).internalElement = this.createInternalElement$();
   this.setupFocusPropagation();
   var shadowRoot = this.element.createShadowRoot();
   shadowRoot.appendChild(privates(this).internalElement);
 
   GuestViewInternalNatives.RegisterView(this.viewInstanceId, this, viewType);
 }
 
+// Prevent GuestViewContainer inadvertently inheriting code from the global
+// Object, allowing a pathway for executing unintended user code execution.
+GuestViewContainer.prototype.__proto__ = null;
+
 // Forward public API methods from |proto| to their internal implementations.
 GuestViewContainer.forwardApiMethods = function(proto, apiMethods) {
   var createProtoHandler = function(m) {
     return function(var_args) {
       var internal = privates(this).internal;
       return $Function.apply(internal[m], internal, arguments);
     };
   };
   for (var i = 0; apiMethods[i]; ++i) {
     proto[apiMethods[i]] = createProtoHandler(apiMethods[i]);
@@ skipping 250 matching lines @@
   // Delete the callbacks so developers cannot call them and produce unexpected
   // behavior.
   delete proto.createdCallback;
   delete proto.attachedCallback;
   delete proto.detachedCallback;
   delete proto.attributeChangedCallback;
 }
 
 // Exports.
 exports.$set('GuestViewContainer', GuestViewContainer);