VULNERABILITY DETAILS
By manipulating document.domain within both a parent and a frame loaded from a sub domain, it is possible to create an iframe that is hidden from the parent, yet the iframe can still access objects within the parent. (e.g the DOM and scripts.)

VERSION
Chrome Version: Version 48.0.2564.109 m
Operating System: Windows 10

REPRODUCTION CASE
Attached is ZIP of two files: main.html, frame.html
Run these within a web server (HTTP, port 80), where both "testdomain.com" and "subdomain.testdomain.com" both point to the web server.
The frame will alter the DOM of the parent and run a script from it, even though it has a different value for document.domain.
 

Deleted: same_origin_restriction_violation.zip 803 bytes

same_origin_restriction_violation.zip 803 bytes Download