sandboxed-iframe-history-denied.html

<html>
<head>
<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}

function loaded() {
    if (window.testRunner)
        testRunner.notifyDone();
}
</script>
</head>
<body>
  <p>This test verifies that a sandboxed IFrame cannot access the history object of the top-level frame.
  It passes if an uncaught exception is present, noting that the inner frame cannot access the outer.</p>
<iframe sandbox="allow-scripts" src="data:text/html,<script>top.history</script>" onload="loaded()">
</body>
</html>

chromium/third_party/blink/web_tests/fast/frames/sandboxed-iframe-history-denied.html