Bisect points to this range: https://chromium.googlesource.com/chromium/src/+log/8a3777d77af8e154f4eb03bfa87a8c73b58fa880..6dc5f17704d3b1465ab48f25a11b7c9979892df3

Alex,  https://chromium.googlesource.com/chromium/src/+/9ab970c98034692afa06d7f4bb1ff813d2ffd3f2 is the only navigation related change in the range. Can you please take a look? Thanks.

I've confirmed that this is indeed due to my r377832.  I'll investigate what's happening exactly.

I believe this only affects cross-process popups.  I'm pretty sure the original test case only works because it uses www.google.com for the popup, which is put in a separate process because Google is the default search provider.  This didn't repro for me if the popup's initial URL is changed to any other site.

OK, found the problem.  Before my patch, proxy navigations went through RenderFrameHostImpl::OpenURL, which validated the destination URL with FilterURL() before passing the request on to NavigatorImpl.  When we switched them to the transfer path, we lost the FilterURL coverage (NavigatorImpl::RequestTransferURL does some URL validation with ShouldAllowOpenURL, but that apparently doesn't cover what FilterURL covers).  The actual blocking for these cases happens in ChildProcessSecurityPolicyImpl::CanCommitURL, called as part of FilterURL.

The solution should be simple -- add FilterURL validation in RenderFrameProxyHost::OnOpenURL.  Charlie, does that sound right to you?

Yes, that sounds exactly right.  Thanks for looking into it!

Fix up for review at https://codereview.chromium.org/1812723002/

Is this bug higher than low severity?

Alex: Thanks for the quick fix!

chromium.khalil: Simply opening a chrome:// or file:// url shouldn't be dangerous by itself (none of the items in medium severity list at https://www.chromium.org/developers/severity-guidelines apply), but if you could demonstrate that this bug could be chained with another bug or lead to privilege escalation we are happy to reevaluate its severity.

For example, can the opener read the contents of the file:// URL? That would definitely raise the severity to medium.

Mustafa, Hmm I understood now. Thanks a lot! 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/5b50b674d36956c84a499b4f93e65a874de28713

commit 5b50b674d36956c84a499b4f93e65a874de28713
Author: alexmos <alexmos@chromium.org>
Date: Thu Mar 17 20:38:05 2016

Add URL validation to navigations initiated via RenderFrameProxyHosts.

When we changed RenderFrameProxyHost::OnOpenURL to use the transfer
logic in r377832, we lost FilterURL validation provided by
RenderFrameHostImpl::OpenURL.  This CL adds that validation to
navigations initiated via proxies.

BUG= 595339 
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_site_isolation

Review URL: https://codereview.chromium.org/1812723002

Cr-Commit-Position: refs/heads/master@{#381788}

[modify] https://crrev.com/5b50b674d36956c84a499b4f93e65a874de28713/content/browser/frame_host/render_frame_proxy_host.cc
[modify] https://crrev.com/5b50b674d36956c84a499b4f93e65a874de28713/content/browser/site_per_process_browsertest.cc

This should be fixed now.  chromium.khalil: thanks for the report!

Should this be merged to beta?

Your change meets the bar and is auto-approved for M50 (branch: 2661)

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/52505b8cec39e5dcbf8e04f6dbe7ea1b92890e49

commit 52505b8cec39e5dcbf8e04f6dbe7ea1b92890e49
Author: Alex Moshchuk <alexmos@chromium.org>
Date: Tue Mar 22 23:48:24 2016

Add URL validation to navigations initiated via RenderFrameProxyHosts.

When we changed RenderFrameProxyHost::OnOpenURL to use the transfer
logic in r377832, we lost FilterURL validation provided by
RenderFrameHostImpl::OpenURL.  This CL adds that validation to
navigations initiated via proxies.

BUG= 595339 
TBR=creis@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_site_isolation

Review URL: https://codereview.chromium.org/1812723002

Cr-Commit-Position: refs/heads/master@{#381788}
(cherry picked from commit 5b50b674d36956c84a499b4f93e65a874de28713)

Review URL: https://codereview.chromium.org/1821043005 .

Cr-Commit-Position: refs/branch-heads/2661@{#350}
Cr-Branched-From: ef6f6ae5e4c96622286b563658d5cd62a6cf1197-refs/heads/master@{#378081}

[modify] https://crrev.com/52505b8cec39e5dcbf8e04f6dbe7ea1b92890e49/content/browser/frame_host/render_frame_proxy_host.cc
[modify] https://crrev.com/52505b8cec39e5dcbf8e04f6dbe7ea1b92890e49/content/browser/site_per_process_browsertest.cc

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Thanks for taking the time to report this issue - our reward panel decided in $500 for this report.

We'll start payment next week.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot