You can take a false Number , Boolean .... from the iframe and extend its prototype.
Basically the following doesn't work, because Numbers are a primitive value.
var x = 0; x.test = 'yo'; console.log(x.test);
It does, but obviously it pollutes Number.prototype, so you really have to take another Number object from another iframe.
var x = 0; Number.prototype.test = 'yo'; console.log(x.test);
Ultimately, just not a good idea.
source share