LayoutTests/http/tests/security/resources/xss-DENIED-assign-location-search-attacker.html

<script>
var victim = parent;

victim.location.search = "?hax0red";
</script>