An empty document did not apply the owner’s document sandbox flags, This meant that with “allow-same-origin” it was possible to open a new window and escape the sandbox. https://issues.chromium.org/issues/40057525