Set prototype for GuestView*.prototype to null.

extensions/renderer/resources/guest_view/guest_view_attributes.js

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This module implements the base attributes of the GuestView tags.
 
 // -----------------------------------------------------------------------------
 // Attribute object.
 
 // Default implementation of a GuestView attribute.
 function Attribute(name, view) {
   this.dirty = false;
   this.ignoreMutation = false;
   this.name = name;
   this.view = view;
 
   this.defineProperty();
 }
 
+// Prevent GuestViewEvents inadvertently inheritng code from the global Object,
+// allowing a pathway for unintended execution of user code.
+// TODO(wjmaclean): Use utils.expose() here instead, track down other issues
+// of Object inheritance. https://crbug.com/701034
+Attribute.prototype.__proto__ = null;
+
 // Retrieves and returns the attribute's value.
 Attribute.prototype.getValue = function() {
   return this.view.element.getAttribute(this.name) || '';
 };
 
 // Retrieves and returns the attribute's value if it has been dirtied since
 // the last time this method was called. Returns null otherwise.
 Attribute.prototype.getValueIfDirty = function() {
   if (!this.dirty)
     return null;
@@ skipping 103 matching lines @@
 
 var GuestViewAttributes = {
   Attribute: Attribute,
   BooleanAttribute: BooleanAttribute,
   IntegerAttribute: IntegerAttribute,
   ReadOnlyAttribute: ReadOnlyAttribute
 };
 
 // Exports.
 exports.$set('GuestViewAttributes', GuestViewAttributes);