Issue 4586 - Prevent access to shadowRoot via contentWindow This improves on Dave's previous fix for this issue. Currently we're wrapping Element.prototype.shadowRoot. With this fix we also wrap HTMLIFrameElement.prototype.contentWindow to prevent access to the original shadowRoot via that route. We also have to hold on to references to certain APIs like Object.defineProperty and HTMLIFrameElement.prototype.sandbox, just in case those are overridden by the site to bypass us. I have tested this on Chrome 49 as well as the latest Chrome and it works fine.
Total messages: 5