Closed window references bypass extension

[NDevTK]

frame = document.createElement('iframe');
document.body.appendChild(frame);
ref = frame.contentWindow;
document.body.removeChild(frame);

setTimeout(() => {
    console.log('Real: ', ref.navigator.userAgent);
}, 1000)

console.log('Fake: ', navigator.userAgent);

[kkapsner]

This is a bad one... not sure if I can do anything about that. The underlying window object seems to get deleted and the recreated:

[NDevTK]

If document.createElement was proxied it could be that after the element is deleted calls to .contentWindow would just fail.
Yeah sandboxing JS is hard there's a project https://github.com/lavamoat/snow just for this purpose but even that's got bypasses.

[kkapsner]

.contentWindow is already protected and the protection works if the timeout is called earlier:

var frame = document.createElement('iframe');
document.body.appendChild(frame);
var ref = frame.contentWindow;
document.body.removeChild(frame);

[0, 1, 10, 100, 1000].forEach(function(timeout){
    setTimeout(() => {
        console.log('timeout', timeout, ":", ref.navigator.userAgent);
    }, timeout)
});

console.log('directly: ', ref.navigator.userAgent);

I even saw the timeout 10 to still be protected.

So it's something that is happening in the background.