UserAgent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.77 YaBrowser/17.1.0.1334 (beta) Yowser/2.5 Safari/537.36

Steps to reproduce the problem:
1. Install attached extension
2. Open background page inspector
3. Read console output

In this extension I mock original chrome object with dummy empty object, and place original chrome into this new mock object prototype.

let originalChrome = window.chrome;
window.chrome = {
	__proto__: originalChrome
}

Just like "overrideChrome" function in test_api.js do:
https://cs.chromium.org/chromium/src/chrome/test/data/webui/test_api.js?dr=CSs&sq=package:chromium&l=1100

Then print chrome object keys. It's expected to be empty:
console.log(Object.keys(chrome));

Then I access to management api:
console.log(chrome.management);

And then, again print chrome object keys: 
console.log(Object.keys(chrome));

What is the expected behavior?
Again i'm expecting to have empty keys list

What went wrong?
I find "management" key here. So "chrome.management" api was moved from prototype to my nested object.

WebStore page: 

Did this work before? No 

Chrome version: 55.0.2883.77  Channel: n/a
OS Version: 6.1 (Windows 7, Windows Server 2008 R2)
Flash Version: Shockwave Flash 24.0 r0

I thinks, this is because of LazyFieldGetterInner realization which does not take into account that this getter can be called through prototype chain
https://cs.chromium.org/chromium/src/extensions/renderer/module_system.cc?dr=CSs&sq=package:chromium&rcl=1481775657&l=494
 

Deleted: extension.zip 703 bytes

extension.zip 703 bytes Download