code: function (sender, target) {
    return (target.getLastWebPreferences().openerId === sender.id) ||
           (sender.getLastWebPreferences().nodeIntegration === true) ||
           isSameOrigin(sender.getURL(), target.getURL())
  }
docs: Checks whether |sender| can access the |target|: 1. Check whether |sender| is the parent of |target|. 2. Check whether |sender| has node integration, if so it is allowed to do anything it wants. 3. Check whether the origins match.  However it allows a child window without node integration but with same origin to do anything it wants, when its opener window has node integration. The W3C does not have anything on this, but from my understanding of the security model of |window.opener|, this should be fine.