Code: bool V8DOMWindow::namedSecurityCheckCustom(v8::Local<v8::Object> host, v8::Local<v8::Value> key, v8::AccessType type, v8::Local<v8::Value>)
{
    v8::Isolate* isolate = v8::Isolate::GetCurrent();
    v8::Handle<v8::Object> window = host->FindInstanceInPrototypeChain(V8DOMWindow::GetTemplate(isolate, worldTypeInMainThread(isolate)));
    if (window.IsEmpty())
        return false;  // the frame is gone.

    DOMWindow* targetWindow = V8DOMWindow::toNative(window);

    ASSERT(targetWindow);

    Frame* target = targetWindow->frame();
    if (!target)
        return false;

    if (target->loader()->stateMachine()->isDisplayingInitialEmptyDocument())
        target->loader()->didAccessInitialDocument();

    if (key->IsString()) {
        DEFINE_STATIC_LOCAL(AtomicString, nameOfProtoProperty, ("__proto__", AtomicString::ConstructFromLiteral));

        String name = toWebCoreString(key);
        Frame* childFrame = target->tree()->scopedChild(name);
        if (type == v8::ACCESS_HAS && childFrame)
            return true;
        if (type == v8::ACCESS_GET && childFrame && !host->HasRealNamedProperty(key->ToString()) && name != nameOfProtoProperty)
             return true;
     }
 
    return BindingSecurity::shouldAllowAccessToFrame(target, DoNotReportSecurityError);
}

Vulnerability Type: Bypass 
CWE ID: 
Summary: Google Chrome before 27.0.1453.110 allows remote attackers to bypass the Same Origin Policy and trigger namespace pollution via unspecified vectors.
Commit Message: Named access checks on DOMWindow miss navigator

The design of the named access check is very fragile. Instead of doing the
access check at the same time as the access, we need to check access in a
separate operation using different parameters. Worse, we need to implement a
part of the access check as a blacklist of dangerous properties.

This CL expands the blacklist slightly by adding in the real named properties
from the DOMWindow instance to the current list (which included the real named
properties of the shadow object).

In the longer term, we should investigate whether we can change the V8 API to
let us do the access check in the same callback as the property access itself.

BUG=237022

Review URL: https://chromiumcodereview.appspot.com/15346002

git-svn-id: svn://svn.chromium.org/blink/trunk@150616 bbb929c8-8fbe-4397-9dbb-9b2b20218538