UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.98 Safari/537.36

Steps to reproduce the problem:
1.  Add bookmark and set URL to javascript:alert(1)
2. While visiting any website, if you click that bookmark, it will execute javascript on that website.

What is the expected behavior?
Does not allow javascript: bookmark (maybe)

What went wrong?
When clicking bookmark, Chrome tries to open that URL on current window. Therefore javascript executes on that website. Further more, Dropjacking (https://bugs.chromium.org/p/chromium/issues/detail?id=639750) that I report allow Drag and Drop to add new Bookmark. Which is very useful for this attack.

Did this work before? N/A 

Chrome version: 54.0.2840.98  Channel: stable
OS Version: OS X 10.11.6
Flash Version: Shockwave Flash 23.0 r0