LayoutTests/http/tests/security/resources/xss-DENIED-window-open-parent-attacker.html

<script>
internals.withUserGesture(() => {
    open("javascript:alert('failed')", "_top");
    parent.postMessage("", "*");
});
</script>