Cross-origin access to 'window.open' and 'window.opener' should throw a SecurityError. On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE". PASS frame.contentWindow.open() threw exception SecurityError: Failed to read a named property 'open' from 'Window': Blocked a frame with origin "http://127.0.0.1:8000" from accessing a cross-origin frame.. PASS frame.contentWindow.opener = 1; threw exception SecurityError: Failed to set a named property 'opener' on 'Window': Blocked a frame with origin "http://127.0.0.1:8000" from accessing a cross-origin frame.. PASS successfullyParsed is true TEST COMPLETE