UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36

Example URL:

Steps to reproduce the problem:
1. create a server on port 12345 (nc -l 12345)
2. create an extension like below
3. open a webpage *as a popup* that redirects to that server, i.e. location.href = 'localhost:12345' or go to this data url data:text/html;base64,PGh0bWw+PGJvZHk+PHNjcmlwdD53aW5kb3cubG9jYXRpb249J2h0dHA6Ly9sb2NhbGhvc3Q6MTIzNDUnOzwvc2NyaXB0PjwvYm9keT48L2h0bWw+

The server will get a request even though the extension closed the tab before.

What is the expected behavior?
the tab should close immediately, cancelling the loading of the page, or at least not execute the redirect

What went wrong?
I created a small extension that listenes to onUpdated:

block.js:
  chrome.tabs.onUpdated.addListener(function(tabId, changeInfo, tab) {
    console.log(changeInfo);
    if (changeInfo.status !== "loading" || !changeInfo.url) return;
    if (!changeInfo.url.startsWith("data:text/html;")) return;

    console.log("closing malicious tab for url:", changeInfo.url);
    chrome.tabs.remove(tab.id);
  });

manifest.json:
  {
    "manifest_version": 2,
    "name": "Sample extension",
    "version": "1.0",
    "permissions": [ "tabs", "activeTab" ],
    "background": {
        "scripts": [ "block.js" ]
    }
  }

This should close any tab that loads a data:text/html url. This seems to be a new way of creating ad popups - by creating a popup to about:blank and then replacing it's location with a data: url that redirects to the actual ad content.

The extension get's this changeInfo:
Object {status: "loading", url: "data:text/html;base64,PGh0bW(...)"}

Then it calls tabs.remove() which closes the tab. Then it receives another update:
Object {status: "complete"}

Result: the server gets a HTTP request.
This does NOT happen, when the first load is not a popup to about:blank, but is navigated to directly.

Again, to be precise:
-----------------------

1. Open a popup to about:blank: 

    w = window.open("about:blank");

  -> the extension will get two updates: loading/about:blank and complete

2. Replace with data: 

    w.location.replace("data:...")

  -> the extension will get an update loading/data:... and remove the tab
  -> the extension will then get another update complete
  -> the server (netcat in my case) will get an HTTP request.

Doing this without popup or location.replace did not result in an HTTP request. I'm unaware of any other possible way to stop this request from happening, since content scripts are not allowed in data: urls.

Did this work before? N/A 

Chrome version: 48.0.2564.116  Channel: stable
OS Version: Linux Mint 17.1
Flash Version: