Properties are accessible in a sandboxed iframe

13

13

13

13

const props = Object.getOwnPropertyNames(window);0x0D
for(const prop in document){0x0D
  try{0x0D
       props.push("document."+prop);0x0D
  } catch{}0x0D
}0x0D
props.forEach(prop => {0x0D
    try {0x0D
         if(typeof parent[prop] !== 'undefined') {0x0D
             log("parent."+prop);0x0D
          }0x0D
    } catch{}0x0D
})

1337