From a60446deb9b42b19bc67c97b2e3808baa50a376e Mon Sep 17 00:00:00 2001
From: Dmitry Vorotilin <d.vorotilin@gmail.com>
Date: Fri, 16 Oct 2026 14:58:23 +0300
Subject: [PATCH] fix(browser): drop --disable-web-security from default Chrome
 flags

The flag turned off the same-origin policy for every page, so tools loading untrusted pages (screenshots,
scraping) let them read other origins. Test suites that rely on it move the flag to Cuprite.
Frame#frame_element now returns nil for a cross-origin frame. Closes #472.
---
 CHANGELOG.md                         |  3 +++
 docs/15-frames.md                    |  4 +++-
 lib/ferrum/browser/options/chrome.rb |  1 -
 lib/ferrum/frame/dom.rb              |  3 ++-
 spec/browser_spec.rb                 | 19 ++++++++++++++++++-
 spec/frame_spec.rb                   | 11 +++++++++--
 6 files changed, 35 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index eb2c3dbc..4c5ee630 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,9 @@
 ### Added
 
 ### Changed
+- `--disable-web-security` is no longer among the default Chrome flags, so pages keep the same-origin policy and an
+  untrusted page can't read local files with `<iframe src="file:///etc/passwd">`. `Frame#frame_element` returns `nil`
+  for a cross-origin frame now. Pass `browser_options: { "disable-web-security" => nil }` for the old behavior [#472]
 
 ### Fixed
 - A paused request with a binary body, e.g. a `Blob` upload with `blacklist=`/`whitelist=` set, hung forever: Chrome
diff --git a/docs/15-frames.md b/docs/15-frames.md
index b1666ea0..593182b5 100644
--- a/docs/15-frames.md
+++ b/docs/15-frames.md
@@ -55,7 +55,9 @@ Parent frame if this one is nested in another one.
 
 #### frame_element : `Node | nil`
 
-Returns the element in which the window is embedded.
+Returns the element in which the window is embedded. It's `nil` for the main
+frame and for a frame from a different origin than its parent, since the
+same-origin policy hides `window.frameElement` from a cross-origin frame.
 
 #### execution_id : `Integer`
 
diff --git a/lib/ferrum/browser/options/chrome.rb b/lib/ferrum/browser/options/chrome.rb
index 65381071..1468890c 100644
--- a/lib/ferrum/browser/options/chrome.rb
+++ b/lib/ferrum/browser/options/chrome.rb
@@ -48,7 +48,6 @@ class Chrome < Base
           "disable-smooth-scrolling" => nil,
           "disable-sync" => nil,
           "disable-translate" => nil,
-          "disable-web-security" => nil,
           "enable-automation" => nil,
           "enable-features" => %w[
             NetworkService
diff --git a/lib/ferrum/frame/dom.rb b/lib/ferrum/frame/dom.rb
index 22db9476..3cf1492b 100644
--- a/lib/ferrum/frame/dom.rb
+++ b/lib/ferrum/frame/dom.rb
@@ -116,7 +116,8 @@ def body
       # Returns the element in which the window is embedded.
       #
       # @return [Node, nil]
-      #   The element in which the window is embedded.
+      #   The element in which the window is embedded, `nil` for the main frame
+      #   and for a frame from a different origin than its parent.
       #
       # @example
       #   browser.go_to("https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe")
diff --git a/spec/browser_spec.rb b/spec/browser_spec.rb
index dfea13fa..d870e07a 100644
--- a/spec/browser_spec.rb
+++ b/spec/browser_spec.rb
@@ -55,14 +55,31 @@
     end
 
     it "supports :ignore_default_browser_options argument" do
-      defaults = Ferrum::Browser::Options::Chrome.options.except("disable-web-security")
+      defaults = Ferrum::Browser::Options::Chrome.options.except("mute-audio")
       browser = Ferrum::Browser.new(ignore_default_browser_options: true,
                                     browser_options: defaults.merge("no-sandbox" => nil))
       browser.go_to(base_url("/console_log"))
+
+      flags = browser.process.command.to_a
+      expect(flags).not_to include("--mute-audio")
+      expect(flags).to include("--no-sandbox")
+      expect(flags).to include(a_string_starting_with("--remote-debugging-port="))
+      expect(flags).to include(a_string_starting_with("--user-data-dir="))
     ensure
       browser&.quit
     end
 
+    it "keeps the same-origin policy by default" do
+      browser.go_to("/frames")
+
+      result = browser.evaluate_async(<<~JS, browser.timeout)
+        fetch("http://localhost:" + location.port + "/headers")
+          .then(() => arguments[0]("read"), () => arguments[0]("blocked"))
+      JS
+
+      expect(result).to eq("blocked")
+    end
+
     it "supports :process_timeout argument" do
       path = "#{PROJECT_ROOT}/spec/support/no_chrome"
 
diff --git a/spec/frame_spec.rb b/spec/frame_spec.rb
index da02e748..ff31b6dd 100644
--- a/spec/frame_spec.rb
+++ b/spec/frame_spec.rb
@@ -234,13 +234,20 @@
 
   context "#frame_element" do
     it "gets the frame element" do
-      page.go_to("/frames")
+      page.go_to("/frame_parent")
 
       frame_element = page.at_xpath("//iframe")
       frame = frame_element.frame
       expect(frame.frame_element).to eq(frame_element)
       expect(frame.frame_element.frame_id).to eq frame.id
-      expect(frame.frame_element.attribute(:src)).to end_with("/slow")
+      expect(frame.frame_element.attribute(:src)).to eq("/frame_child")
+    end
+
+    it "returns nil for a cross-origin frame" do
+      page.go_to("/frames")
+
+      frame = page.at_xpath("//iframe").frame
+      expect(frame.frame_element).to be_nil
     end
 
     it "returns nil if main frame" do