diff --git a/components/js_injection/renderer/js_binding.cc b/components/js_injection/renderer/js_binding.cc index d93325c2a6f01..b115673a6330d 100644 --- a/components/js_injection/renderer/js_binding.cc +++ b/components/js_injection/renderer/js_binding.cc @@ -113,6 +113,14 @@ cppgc::WeakPersistent JsBinding::Install( return nullptr; } + context_scope.emplace(context); + } else if (!context.IsEmpty() && context != isolate->GetCurrentContext()) { + // The caller pre-entered a (main-world) Context::Scope as an + // optimisation, but `context` may be a different (isolated) world. + // gin::WrappableBase::GetWrapper() instantiates the wrapper in + // isolate->GetCurrentContext(), so without this scope the wrapper's + // prototype chain would terminate at the *main-world* Object.prototype, + // letting page script poison it and capture this object. context_scope.emplace(context); } JsBinding* js_binding = cppgc::MakeGarbageCollected(