LayoutTests/http/tests/security/resources/xss-DENIED-window-open-parent-attacker.html

<script>
open("javascript:alert('failed')", "_top");
parent.postMessage("", "*");
</script>